When BARE_OS_WAVE11_PROC is 0, false, or off, omit the 20 Wave 11

flat /proc/bare_os_*.json names, matching /proc/bare_os/* aliases, and their bare_os_proc_index rows; resolution behaves as missing reads. Pass the variable through the booter host→shell env allowlist. Add a VFS test driven by BARE_OS_WAVE11_PROC_FILE_TO_ID. Document the toggle and Wave 11 summary in kernel-extensions and the capabilities index; extend release-checklist and node-to-bare-modules.
2026-04-04 06:39:31 -04:00
parent b3eac448d1
commit 21a05806b4
53 changed files with 2102 additions and 465 deletions
@@ -13,6 +13,7 @@ When building custom NDJSON / OTel mirrors or Pear-side aggregators, treat these
 - **Wave 8 fields:** `sessionForkGeneration`, `vaultRotateCount`, multisig / trust-graph ids surfaced as pointers, OIDC publishing URLs, subprocess **`uidGidMapHint`**, RocksDB / sidecar manifest pointers — treat as operator metadata; scrub before cross-tenant export.
 - **Wave 9 fields:** `wave9ProbeId`, `bareModuleProbeClass`, Pear stage / appling / updater / radio / wakeups sketches from **`BARE_OS_*_JSON`** env mirrors, SOCKS / HTTP proxy map keys (host-only interpretation) — treat as deployment fingerprinting; scrub or bucket before multi-tenant export.
 - **Wave 10 fields:** `wave10ProbeId`, `bareRpcProbeClass`, Pear doctor / workshop / RTI / user-dirs sketches, Bare logger tap payloads, mTLS proxy map keys, thread-pool telemetry JSON — treat as operator metadata; scrub before cross-tenant export.
+- **Wave 11 fields:** `wave11ProbeId`, hypercore replicate budget / drive graph / protomux backpressure / Pear matrix / bundle preload / HRPC allowlist / sidecar cap / git LFS / net QoS / storage tier / indexer catchup / multisig quorum / relay geo sketches — operator hints only; no secret material in stock paths.

 Stock emitters avoid logging env wholesale; `/proc/self/environ` omits secret-like keys. Prefer **hashed** or **bucketed** counters (e.g. pairing backoff counts) over raw payloads.

@@ -22,7 +23,7 @@ Operators running Bare OS as part of a service should maintain a **subprocessor

 ## Schema versions

- NDJSON lifecycle / telemetry: see **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (**9** in stock tree) and rows in [`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md).
+- NDJSON lifecycle / telemetry: see **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (**10** in stock tree) and rows in [`docs/reference/compatibility-matrix.md`](../docs/reference/compatibility-matrix.md).
 - OTel-inspired lines: **`otlSchemaVersion: 7`**, example [`kernel/etc/bare-os/otel-jsonl.example.json`](../kernel/etc/bare-os/otel-jsonl.example.json), schema [`docs/schemas/otel-bare-os-jsonl.schema.json`](../docs/schemas/otel-bare-os-jsonl.schema.json).
 - Audit JSON: **`auditSchemaVersion: 7`** (delegate depth / Wave 9–10 RPC classes); optional **`requestSmugglingClass`** remains default **`none`** in stock emitters where applicable.

@@ -1,4 +1,4 @@
-# ADR 001: Kernel feature bit governance (v8)
+# ADR 001: Kernel feature bit governance (v9)

 ## Status

@@ -39,9 +39,11 @@ Bare OS advertises optional booter and seed-channel capabilities as a versioned

 13. **Tenth capability word (`bits10`, wave 10)** — **`BARE_OS_KERNEL_FEATURES_STOCK_V10`** and **`BARE_OS_FEATURE10_*`** add the tenth 32-bit word. **Word 9 high bits** remain reserved for future wave-9–scoped features; wave 10 uses **`bits10`** for Pear/Bare–inspired seed RPC wave 10, replication JSON adjuncts (bundle tier, autobase-discovery hint, token bucket v4, staging schema 7, peer firewall v5, compact ping v4, ready guard v4, mirror compaction v5, blind relay v3), Wave 10 **`/proc`** JSON (**`bare-os-wave10-proc.js`**), **`bare_os_proc_index`** schema **6**, boot policy v10 (**`requireFeatureBits10`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`extensionSignerPinsV3`**, **`bootPhasesRequireLifecycleMinSchema`**, …), extension registry schema **7**, Pear/Bare bridge **`ctx`** wave 10, worker **`sysproc:*`**, telemetry NDJSON schema **9** / OTel **7** / audit **7**, and CI **`verify-kernel-roadmap-wave10.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`bits10`**. **`BARE_OS_SEED_CAP_STRICT`** requires **`bits10`** to cover the stock tenth word when it is non-zero (same pattern as **`bits9`**).

+14. **Eleventh capability word (`bits11`, wave 11)** — **`BARE_OS_KERNEL_FEATURES_STOCK_V11`** and **`BARE_OS_FEATURE11_*`** add the eleventh 32-bit word. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** is **13** for this wave. Wave 11 groups protocol **`0.7.0`**, twenty new seed RPC methods (replicate budget, drive graph, protomux backpressure, Pear matrix, bundle preload, … through mirror compaction v6), **`bare-os-wave11-proc.js`** with twenty **`/proc/bare_os/*.json`** surfaces, **`bare_os_proc_index`** schema **7**, boot policy v11 (**`requireFeatureBits11`**, **`extensionSignerPinsV4`**, **`requireBarePackMin`**, **`requireBareAddonPolicyMin`**, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireBits11`**, merged **`denySeedRpcMethods`**), extension registry **`/proc`** payload schema **8**, **`ctx`** API **1.20.0** wave-11 probes, worker patterns **`cryptoproc:*`** / **`indexerproc:*`**, telemetry NDJSON **10** / OTel **`otlSchemaVersion` 8** / audit **8**, and CI **`verify-kernel-roadmap-wave11.mjs`**. Seed JSON and **`/proc/bare_os_features`** include **`bits11`**. **`BARE_OS_SEED_CAP_STRICT`** requires **`bits11`** to cover the stock eleventh word when it is non-zero.
+
 **Deprecation (unused bits):** once a bit is published in this ADR and **`kernel-capabilities-index.md`**, its numeric position is **stable**; if a feature is removed from the stock booter, the bit stays reserved (document as “unused / reserved”) until a major governance revision. **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** bumps when semantics or this policy changes.

 ## Consequences

- Seeder RPC `bare_os.capabilities` must return `protocolPackageVersion`, optional **`booterPackageVersion`**, and `featureBitsDoc` alongside `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, and **`bits10`** (omit zero words if desired; the stock seeder sends all ten today).
- CI should keep seeder and booter copies of the stock masks aligned (`BARE_OS_KERNEL_FEATURES_STOCK_V1`, **`STOCK_V2`**, **`STOCK_V3`**, **`STOCK_V4`**, **`STOCK_V5`**, **`STOCK_V6`**, **`STOCK_V7`**, **`STOCK_V8`**, **`STOCK_V9`**, **`STOCK_V10`**).
+- Seeder RPC `bare_os.capabilities` must return `protocolPackageVersion`, optional **`booterPackageVersion`**, and `featureBitsDoc` alongside `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`**, and **`bits11`** (omit zero words if desired; the stock seeder sends all eleven today).
+- CI should keep seeder and booter copies of the stock masks aligned (`BARE_OS_KERNEL_FEATURES_STOCK_V1`, **`STOCK_V2`**, **`STOCK_V3`**, **`STOCK_V4`**, **`STOCK_V5`**, **`STOCK_V6`**, **`STOCK_V7`**, **`STOCK_V8`**, **`STOCK_V9`**, **`STOCK_V10`**, **`STOCK_V11`**).
@@ -20,3 +20,5 @@ Bare OS **guest** code (kernel `/boot/init.js`, `/bin` utilities running in the
 Stock **`/bin/openssl`** is a **stub** that points integrators at **`bare-crypto`** (see [`packages/bare-os-coreutils/src/openssl.js`](../../packages/bare-os-coreutils/src/openssl.js)).

 See also [kernel-extensions.md](../docs/reference/kernel-extensions.md), [handbook ch.11](../handbook/11-kernel-roadmap-and-research.md), and CI **`verify-pear-no-static-node-import.mjs`**.
+
+**Wave 11:** stock boot policy may pin **`bare-pack`** / **`bare-addon-policy`** (and related) versions via host env keys surfaced in **`boot.policy.json` v11**; Hypercore/replication-heavy guests should prefer Holepunch **`bare-*`** modules over Node **`node:*`** for the same capability areas as in the table above (see **`bits11`** / **`STOCK_V11`** in [compatibility-matrix.md](../docs/reference/compatibility-matrix.md)).
@@ -4,15 +4,15 @@ Single place to compare **protocol**, **booter `ctx` API**, **feature-bit docume

 | Artifact | Location | Current (stock) |
 | --- | --- | --- |
-| **`bareOsCtxApiVersion`** | [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js) | `1.19.0` |
-| **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** | [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js) | `12` |
-| **Capability words** | `bare_os.capabilities` RPC + `/proc/bare_os_features` | `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`** |
-| **Lifecycle / telemetry NDJSON** | `BARE_OS_LIFECYCLE_SCHEMA_VERSION` in [`bare-os-lifecycle-schema.js`](../../packages/bare-os-booter/lib/bare-os-lifecycle-schema.js) | `9` |
+| **`bareOsCtxApiVersion`** | [`packages/bare-os-booter/lib/bare-os-ctx-api.js`](../../packages/bare-os-booter/lib/bare-os-ctx-api.js) | `1.20.0` |
+| **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** | [`packages/bare-os-protocol/lib/kernel-feature-bits.js`](../../packages/bare-os-protocol/lib/kernel-feature-bits.js) | `13` |
+| **Capability words** | `bare_os.capabilities` RPC + `/proc/bare_os_features` | `bits`, `bits2`, `bits3`, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`**, **`bits11`** |
+| **Lifecycle / telemetry NDJSON** | `BARE_OS_LIFECYCLE_SCHEMA_VERSION` in [`bare-os-lifecycle-schema.js`](../../packages/bare-os-booter/lib/bare-os-lifecycle-schema.js) | `10` |
 | **Protocol package** | [`bare-os-protocol` `package.json`](../../packages/bare-os-protocol/package.json) | see workspace version |

 ## Peer assumptions

- **Seeder** must answer **`bare_os.capabilities`** with **`bits4`** / **`bits5`** / **`bits6`** / **`bits7`** / **`bits8`** / **`bits9`** / **`bits10`** when using a current **`bare-os-protocol`** build; older seeders omit newer words (zeros) — use **`BARE_OS_SEED_CAP_STRICT`** only when peers are upgraded.
+- **Seeder** must answer **`bare_os.capabilities`** with **`bits4`** … **`bits11`** when using a current **`bare-os-protocol`** build; older seeders omit newer words (zeros) — use **`BARE_OS_SEED_CAP_STRICT`** only when peers are upgraded.
 - **Offline LKG** booters skip the swarm peer wait when **`BARE_OS_OFFLINE_LKG_BOOT=1`** and **`BARE_OS_LKG_SYSTEM_KEY_HEX`** is set; the system drive must already contain **`/boot/init.js`** in Corestore.

 ## See also
@@ -575,4 +575,109 @@ This file tracks the twenty-item “kernel super-features” plan. Items are **d
 | 99 | Audit JSON schema 7 | done — index.js + kernel-runner.js |
 | 100 | Mega-integration wave10 + parity | done — pretest + seeder kernel sync |

+## Wave 11 (100-item mega kernel)
+
+| # | Item | Status |
+|---|------|--------|
+| 1 | bits11 + STOCK_V11 + FEATURE11_* + BARE_OS_KERNEL_FEATURE_BITS_DOC=13 | done — kernel-feature-bits.js, protocol |
+| 2 | ADR 001 §14 eleventh capability word | done — developer-guide/adr/001 |
+| 3 | Protocol 0.7.0 + protocol-meta + package semver | done — bare-os-protocol |
+| 4 | channel.js bits11 + seed RPC wave 11 handlers | done — channel.js |
+| 5 | BARE_OS_SEED_CAP_STRICT bits11 stock coverage | done — booter index.js |
+| 6 | Offline LKG seedCapabilityInfo bits11 | done — loadOsFromOfflineLkg |
+| 7 | verify-kernel-roadmap-wave11.mjs + pretest | done — scripts |
+| 8 | verify-kernel-roadmap-wave3 STOCK_V11 + RPC + boot v11 | done — wave3.mjs |
+| 9 | verify-ctx-api-feature-bits bits11 + doc 13 | done — scripts |
+| 10 | BARE_OS_CTX_API_VERSION 1.20.0 | done — bare-os-ctx-api.js |
+| 11 | bare-os-ctx.d.ts bits11 + wave11 ctx methods | done — typings |
+| 12 | Seed RPC hypercore_replicate_budget_v2 | done — seed-rpc + channel |
+| 13 | Seed RPC drive_version_graph | done — seed-rpc + channel |
+| 14 | Seed RPC protomux_backpressure_v3 | done — seed-rpc + channel |
+| 15 | Seed RPC pear_runtime_matrix | done — seed-rpc + channel |
+| 16 | Seed RPC bundle_preload_hint | done — seed-rpc + channel |
+| 17 | Seed RPC autopass_rotation_hint | done — seed-rpc + channel |
+| 18 | Seed RPC hrpc_method_allowlist | done — seed-rpc + channel |
+| 19 | Seed RPC sidecar_resource_cap | done — seed-rpc + channel |
+| 20 | Seed RPC git_lfs_budget | done — seed-rpc + channel |
+| 21 | Seed RPC net_qos_class | done — seed-rpc + channel |
+| 22 | Seed RPC storage_tier_hint | done — seed-rpc + channel |
+| 23 | Seed RPC indexer_catchup | done — seed-rpc + channel |
+| 24 | Seed RPC multisig_quorum_hint | done — seed-rpc + channel |
+| 25 | Seed RPC relay_geo_hint | done — seed-rpc + channel |
+| 26 | Seed RPC compact_ping_v5 | done — seed-rpc + channel |
+| 27 | Seed RPC staging_slot_v8 | done — seed-rpc + channel |
+| 28 | Seed RPC peer_firewall_stats_v6 | done — seed-rpc + channel |
+| 29 | Seed RPC http_dht_proxy_routes_v3 | done — seed-rpc + channel |
+| 30 | Seed RPC ready_guard_v5 | done — seed-rpc + channel |
+| 31 | Seed RPC mirror_drive_compaction_v6 | done — seed-rpc + channel |
+| 32 | Seeder BARE_OS_SEED_* passthrough wave11 | done — bare-os-seeder index.js |
+| 33 | bare-os-wave11-proc.js 20 /proc JSON builders | done — booter lib |
+| 34 | VFS BARE_OS_WAVE11_PROC_FILE_TO_ID + routing | done — vfs.js |
+| 35 | bare_os_proc_index schema 7 + wave11 entries | done — vfs.js |
+| 36 | ctx wave11 emitters/probes (hypercore, drive graph, …) | done — index.js |
+| 37 | BARE_OS_WAVE11_PROBE_ID env passthrough | done — index.js + var-log |
+| 38 | boot.policy v11 schema keys | done — boot.policy.schema.json |
+| 39 | requireFeatureBits11 enforcement | done — kernel/init.js |
+| 40 | extensionSignerPinsV4 env JSON | done — kernel/init.js |
+| 41 | requireBarePackMin / requireBareAddonPolicyMin | done — kernel/init.js |
+| 42 | maxHrpcAllowlistDepth env | done — kernel/init.js |
+| 43 | offlineLkgRequireBits11 env | done — kernel/init.js |
+| 44 | denySeedRpcMethods merge with prior env | done — kernel/init.js |
+| 45 | boot trace NDJSON wave11 probe fields | done — kernel/init.js bootTimed |
+| 46 | /proc/extensions.json schema 8 payload | done — procBareOsExtensionsText |
+| 47 | BARE_OS_BARE_PACK_VERSION / ADDON_POLICY_VERSION passthrough | done — booter shell env |
+| 48 | cryptoproc:* + indexerproc:* worker patterns | done — kernel-runner.js |
+| 49 | NDJSON lifecycle schema 10 + telemetry mirror | done — lifecycle-schema + var-log |
+| 50 | OTel otlSchemaVersion 8 | done — var-log + schema |
+| 51 | auditSchemaVersion 8 | done — index.js + kernel-runner.js |
+| 52 | host-delegate-registry sidecar + pear_runtime_matrix stubs | done — host-delegate-registry.js |
+| 53 | boot.policy.example.json v11 fields | done — kernel/etc |
+| 54 | telemetry-ndjson.example lifecycle 10 | done — kernel/etc |
+| 55 | otel-jsonl.example otlSchemaVersion 8 | done — kernel/etc |
+| 56 | kernel-extensions.registry.schema.json schema 8 branch | done — docs/schemas |
+| 57 | STOCK_V11 !== 0 protocol test | done — packages/bare-os-protocol/test.js |
+| 58 | compatibility-matrix wave 11 row | done — docs/reference |
+| 59 | verify-compat-matrix bits11 | done — scripts |
+| 60 | package-bare-os-protocol.md 0.7.0 pointer | done — docs/reference (sync) |
+| 61 | kernel-capabilities-index FEATURE11_* | done — docs/reference (sync) |
+| 62 | kernel-extensions.md wave11 env/proc | done — docs/reference (sync) |
+| 63 | developer-guide node-to-bare wave11 pointers | done — developer-guide (sync) |
+| 64 | handbook ch.6 boot policy v11 | done — handbook (sync) |
+| 65 | handbook ch.3 protocol 0.7 / bits11 | done — handbook (sync) |
+| 66 | README + DOCUMENTATION wave11 headline | done — root docs (sync) |
+| 67 | PEAR-RUN + booter README ctx 1.20 | done — package READMEs (sync) |
+| 68 | scripts/README.md wave11 verifier | done — scripts/README.md (sync) |
+| 69 | privacy telemetry PII wave11 keys | done — developer-guide/13 (sync) |
+| 70 | release-checklist wave11 gates | done — scripts/release-checklist.mjs (sync) |
+| 71 | validate-example-schemas wave11 examples | done — validate-example-schemas |
+| 72 | VFS readdir ordering wave11 proc files | done — vfs.js tests / impl |
+| 73 | loadOsFromPeers strict bits11 | done — index.js |
+| 74 | kernel_info / capabilities bits11 adjunct | done — channel.js |
+| 75 | Wave11 proc bare_pack_cache + bare_addon_policy | done — wave11-proc |
+| 76 | Wave11 proc bare_signals_profile + bare_timers_histogram | done — wave11-proc |
+| 77 | ctx bareOsBarePackCacheProbe + bareOsBareAddonPolicyProbe | done — index.js |
+| 78 | ctx bareOsBareSignalsProfile + bareOsBareTimersHistogram | done — index.js |
+| 79 | Stream F VFS env toggles BARE_OS_WAVE11_PROC_* | done — vfs routing |
+| 80 | Stream G coreutils/shell matrix (plan slots) | tracked — handbook + coreutils |
+| 81 | Stream H initd/timer/cron matrix (plan slots) | tracked — handbook |
+| 82 | Stream I workers sandbox subprocess schema bumps | tracked — docs + runner |
+| 83 | Stream J HTTP/DNS/TLS proxy map docs | tracked — kernel-extensions |
+| 84 | Stream K git/hyperdrive storage coherence | tracked — developer-guide |
+| 85 | Stream L Pear desktop IPC updater cross-links | tracked — docs |
+| 86 | Stream M observability schema 10/8/8 | done — lifecycle + var-log + audit |
+| 87 | Stream N bare-* catalog rows (ongoing) | tracked — node-to-bare-modules |
+| 88 | Stream O UI/native doc-only caps | tracked — developer-guide |
+| 89 | Stream P CI brittle-node / brittle-bare splits | tracked — booter test.js |
+| 90 | Stream Q handbook/devguide/reference sweep | tracked — mega doc pass |
+| 91 | Stream R HyperDB/Pear finishing slots | tracked — seed RPC tests |
+| 92 | Stream S release hygiene + compat CI | tracked — pretest matrix |
+| 93 | verify-doc-links wave11 anchors | done — CI |
+| 94 | verify-man-coverage wave11 | done — CI |
+| 95 | verify-pear-no-static-node-import | done — CI |
+| 96 | verify-kernel-seeder-parity after kernel merge | done — pretest |
+| 97 | smoke-bare-manifest imports | done — pretest |
+| 98 | booter CHANGELOG wave11 headline | done — packages/bare-os-booter |
+| 99 | protocol CHANGELOG 0.7.0 | done — packages/bare-os-protocol |
+| 100 | Mega-integration wave11 + seeder kernel parity | done — pretest + rsync kernel |
+
 See also [kernel-extensions.md](kernel-extensions.md) and [package-bare-os-protocol.md](package-bare-os-protocol.md).
@@ -223,6 +223,27 @@ Single map from optional **feature bits** ([`packages/bare-os-protocol/lib/kerne

 **Related `ctx` (1.19.0+):** **`bareOsAdvertisedKernelBits10`**, **`bareOsSeedCapabilityBits10`**, prior-word **`bareOsAdvertisedKernelBits9`** / **`bareOsSeedCapabilityBits9`**, and Wave 10 **`ctx`** hooks above.

+### Word 11 — `bits11` / `BARE_OS_KERNEL_FEATURES_STOCK_V11` (wave 11)
+
+| Bit | Symbol | Primary surfaces | Notes |
+| --- | --- | --- | --- |
+| 0 `FEATURE11_CAP_WORD` | — | seed **`bits11`** + `/proc/bare_os_features` | eleventh word marker |
+| 1 `FEATURE11_SEED_RPC_WAVE11` | `BARE_OS_SEED_*` JSON | `hypercore_replicate_budget_v2` … `mirror_drive_compaction_v6` | [`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js) |
+| 2 `FEATURE11_REPLICATION_JSON_WAVE11` | seeder / replication adjuncts | advisory JSON for wave-11 RPC payloads | pairs with seed channel |
+| 3 `FEATURE11_PROC_METRICS_WAVE11` | Wave 11 `BARE_OS_*_JSON` envs | 20× `bare_os_*.json` + **`bare_os_proc_index`** schema **7** | [`bare-os-wave11-proc.js`](../../packages/bare-os-booter/lib/bare-os-wave11-proc.js) |
+| 4 `FEATURE11_BOOT_POLICY_V11` | `boot.policy.json` v11 | — | **`requireFeatureBits11`**, **`extensionSignerPinsV4`**, pack/addon semver, HRPC depth, offline bits11 |
+| 5 `FEATURE11_KERNEL_EXT_REGISTRY_V8` | extension records | `/proc/bare_os/extensions.json` schema **8** | schema branch in **`kernel-extensions.registry.schema.json`** |
+| 6 `FEATURE11_PEAR_BARE_BRIDGE_WAVE11` | — | — | Pear matrix + Bare pack/addon/signals **`ctx`** probes |
+| 7 `FEATURE11_VFS_POSIX_WAVE11` | VFS / handbook | hide Wave 11 proc JSON via env | **`BARE_OS_WAVE11_PROC`** (`0` / `false` / `off` → flat + `/proc/bare_os/*` + index rows) |
+| 8 `FEATURE11_INITD_SUBPROC_WAVE11` | — | — | shared with prior waves |
+| 9 `FEATURE11_WORKER_NET_WAVE11` | **`cryptoproc:*`**, **`indexerproc:*`** | worker allowlist | [`kernel-runner.js`](../../packages/bare-os-booter/lib/kernel-runner.js) |
+| 10 `FEATURE11_TELEMETRY_AUDIT_WAVE11` | telemetry sinks | NDJSON **10** / OTel **8** / audit **8** | **`wave11ProbeId`** |
+| 11 `FEATURE11_DOC_CI_WAVE11` | — | — | **`verify-kernel-roadmap-wave11.mjs`** |
+| 12 `FEATURE11_HTTP_DHT_PROXY_ROUTES_V3` | — | `http_dht_proxy_routes_v3` RPC | route table v3 |
+| 13 `FEATURE11_COMPACT_READY_RPC_V5` | — | `compact_ping_v5`, `ready_guard_v5` | dedicated v5 payloads |
+
+**Related `ctx` (1.20.0+):** **`bareOsAdvertisedKernelBits11`**, **`bareOsSeedCapabilityBits11`**, and Wave 11 **`ctx`** hooks (**`bareOsEmitHypercoreReplicateBudget`**, **`bareOsPearRuntimeMatrixProbe`**, **`bareOsBarePackCacheProbe`**, …).
+
 **Handbook:** [handbook/09-posix-utilities-shell-and-vfs.md](../../handbook/09-posix-utilities-shell-and-vfs.md), [handbook/04-the-booter-runtime.md](../../handbook/04-the-booter-runtime.md).

 **Extended reference:** [kernel-extensions.md](./kernel-extensions.md), [environment-and-posix-appendix.md](./environment-and-posix-appendix.md).
@@ -10,7 +10,7 @@ New capability bits are governed by [ADR 001 — Kernel feature bit governance](

 ## Capability bitmask

-Runtime bits are defined in `bare-os-protocol` (`kernel-feature-bits.js`) and surfaced under `/proc/bare_os_features` and the **`/proc/bare_os/`** tree. The stock booter advertises **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** … **`STOCK_V10`** (ten words on the wire when non-zero).
+Runtime bits are defined in `bare-os-protocol` (`kernel-feature-bits.js`) and surfaced under `/proc/bare_os_features` and the **`/proc/bare_os/`** tree. The stock booter advertises **`BARE_OS_KERNEL_FEATURES_STOCK_V1`** … **`STOCK_V11`** (eleven words on the wire when non-zero).

 Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optional **`booterPackageVersion`**, **`featureBitsDoc`**, **`doc`**, **`bits`**, **`bits2`**, **`bits3`**, **`bits4`**, **`bits5`**, **`bits6`**, **`bits7`**, **`bits8`**, **`bits9`**, **`bits10`**, **`role`**, **`protocol`**. RPC method names are listed from a single registry ([`seed-rpc-methods.js`](../../packages/bare-os-protocol/lib/seed-rpc-methods.js)); unknown methods return **`bare_os.rpc_unknown_method`**. **`bare_os.replication_status`** returns seeder-side replication hints (manifest path count, local RAM block count). **`bare_os.replication_queue`** includes bounded **`queueDepthEstimate`** and snapshot workflow notes; **`bare_os.capability_attestation`**, and **`bare_os.mbr_layout`** remain optional wave-2 RPCs. Wave 6 adds **`replication_plan`**, **`dht_bootstrap_hint`**, **`snapshot_chain`**, **`mirror_compaction_hint`**, **`updater_state`**, **`blind_peer_topology_v2`**, **`compact_ping`**. Wave 7 adds **`corestore_stats`**, **`snapshot_manifest_slice`**, **`mirror_drive_hint_v2`**, **`hrpc_registry_summary`**, **`protomux_capability_ad`**, **`dht_address_book`**, **`replication_throttle_hint`**, **`bundlebee_stage`**, **`http_dht_proxy_hint`**. Wave 8 adds **`protomux_rpc_pool_hint`**, **`hyperblob_store_hint`**, **`signing_request_queue_hint`**, **`core_storage_layout_hint`**, **`mirror_drive_compaction_v3`**, **`bundlebee_cli_stage`**, **`ready_guard_v2`**, **`blind_relay_circuit_hint`**, **`http_dht_proxy_routes`**. **Wave 9** adds Holepunch-aligned short names such as **`pear_stage_hint`**, **`updater_channel_matrix`**, **`appling_bundle_pointer`**, **`drive_resolve_policy`**, **`bundle_id_fingerprint`**, **`hyperdb_migration_hint`**, **`sidecar_bundle_index_v2`**, **`pear_message_queue_sketch`**, **`runtime_bootstrap_etag`**, **`force_update_guard`**, **`gracedown_window`**, **`tryboot_slot`**, **`hotmods_allowlist`**, **`prefetcher_budget`**, **`opstream_backpressure`**, **`multisig_link_pointer`**, **`md_render_caps`**, **`bundlebee_cli_stage_v2`**, **`seed_manifest_diff_v2`**, **`peer_handshake_latency_budget`**, plus replication adjuncts (**`ready_guard_v3`**, **`mirror_drive_compaction_v4`**, **`blind_relay_circuit_v2`**, **`http_dht_proxy_routes_v2`**, token-bucket metadata, **`compact_ping` v3**, **`peer_firewall_stats` v4**, **`staging_slot` schema 6**, **`kernel_info.pearApplingId`**). **`bare_os.manifest_hints`** returns a sample of manifest paths; **`bare_os.peer_health`** returns seeder health counters; **`bare_os.staging_slot`** returns optional A/B slot hints (seeder env `BARE_OS_SEED_STAGING_SLOT`, `BARE_OS_SEED_STAGING_PENDING`). Booter mirrors hints under **`/proc/bare_os/manifest_hints`**, **`peer_health`**, **`staging_slot`**, **`net_summary.json`**, **`extensions.json`** (schema **7** in wave 10), **`hdms_hints.json`** (schema **3**: optional **`vaultRotateCount`**) and embeds them in **`/proc/bare_os_replication`** JSON. **`/proc/bare_os/index.json`** lists stable aliases (**`bare_os_proc_index` schema 6**). **Wave 10** adds Pear/Bare sketch RPCs (**`pear_doctor_hint`** … **`pear_terminal_caps`**, **`ready_guard_v4`**, **`compact_ping_v4`**, compaction/blind-relay v5/v3), replication adjuncts (**`pearBundleTier`**, **`autobaseDiscoveryHint`**, **`handshakeTokenBucketV4`**, **`staging_slot` schema 7**, **`peer_firewall_stats` v5**), and 19× Wave 10 **`/proc/bare_os/*.json`** files via **`bare-os-wave10-proc.js`**.

@@ -20,6 +20,8 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio

 **Wave 10 Pear/Bare bridge:** **`ctx.bareOsEmitPearDoctorHint`**, **`ctx.bareOsPearInspectProbe`**, **`ctx.bareOsEmitBareBootPhaseHint`**, **`ctx.bareOsBareRpcCapProbe`**, **`ctx.bareOsEmitPearStampPointer`**, **`ctx.bareOsRegisterBareLoggerTap`**, **`ctx.bareOsEmitAutobaseDiscoveryHint`**, **`ctx.bareOsEmitBlindPairingSketch`**, **`ctx.bareOsBareStreamBackpressureHint`**, **`ctx.bareOsPearTerminalCapsProbe`**; host env **`BARE_OS_WAVE10_PROBE_ID`**, **`BARE_OS_BARE_RPC_PROBE_CLASS`**, **`BARE_OS_MTLS_PROXY_MAP_JSON`**, **`BARE_OS_THREAD_POOL_TELEMETRY_JSON`**, **`BARE_OS_HAPPY_EYEBALLS_V4_MODE`**, **`BARE_OS_BARE_BOOT_VERSION`**, **`BARE_OS_BARE_LOGGER_VERSION`**, **`BARE_OS_BARE_TLS_VERSION`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** (injected); boot policy **v10** adds **`requireFeatureBits10`**, **`requireBareBootMin`**, **`denyBareRpcMethodPatterns`**, **`maxPearInspectDepth`**, **`requireBareLoggerMin`**, **`denyAutobaseDiscoveryChannels`**, **`requireBareTlsMin`**, **`extensionSignerPinsV3`**, **`offlineLkgRequirePearStamp`**, **`bootPhasesRequireLifecycleMinSchema`**, …

+**Wave 11** (`bare-os-protocol` **0.7.x**, **`bits11`**): twenty new seed RPC short names (through **`mirror_drive_compaction_v6`**, **`compact_ping_v5`**, **`http_dht_proxy_routes_v3`**, …), boot policy **v11** (**`requireFeatureBits11`**, **`extensionSignerPinsV4`**, pack/addon semver floors, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireBits11`**, merged **`denySeedRpcMethods`**), **`/proc/bare_os/index.json`** schema **7** with 20 Wave 11 JSON aliases, NDJSON lifecycle **10** / OTel **8** / audit **8**, **`kernel-extensions.registry.schema.json`** branch **8**. Host env **`BARE_OS_WAVE11_PROBE_ID`**; optional **`BARE_OS_WAVE11_PROC=0`** (or **`false`** / **`off`**) hides those Wave 11 proc nodes from **`readdir`**, path resolution, and the proc index (see **`vfs.js`**).
+
 **JSON Schemas** (policy, telemetry, boot trace): [`docs/schemas/`](../schemas/) (see also [reference README](./README.md)).

 ## Environment quick reference
@@ -34,8 +36,8 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
 | Union writes          | `BARE_OS_VFS_UNION_WRITE_DENY`                                                         | Comma/colon list of path prefixes blocked for writes under union prefixes                                                                                                                                                                                                                                                                                                             |
 | IPC                   | `BARE_OS_IPC_CHANNEL_MAX_BYTES`                                                        | JSON map `{"fifoName": 65536}` per-channel backlog cap                                                                                                                                                                                                                                                                                                                                |
 | Initd journal         | `BARE_OS_INITD_JOURNAL_MAX_LINES`                                                      | Cap NDJSON lines per unit (default 400, max 20000)                                                                                                                                                                                                                                                                                                                                    |
-| Telemetry             | `BARE_OS_TELEMETRY_NDJSON`                                                             | Logical path; append NDJSON mirror (`telemetrySchemaVersion` / `lifecycleSchemaVersion` **9**); optional **`sessionForkGeneration`**, **`wave9ProbeId`**, **`wave10ProbeId`**, **`bareModuleProbeClass`**, **`bareRpcProbeClass`**; optional correlation via **`BARE_OS_BOOT_ATTEMPT_ID`** → **`bootAttemptId`**                                                                                                                                                                     |
-| Telemetry OTel        | `BARE_OS_TELEMETRY_OTEL_JSONL`                                                         | Logical path; append OTLP-inspired JSON lines (`otlSchemaVersion` **7**, optional **`scopeMetrics`** sketch; see [`otel-bare-os-jsonl.schema.json`](../schemas/otel-bare-os-jsonl.schema.json))                                                                                                                                                                                      |
+| Telemetry             | `BARE_OS_TELEMETRY_NDJSON`                                                             | Logical path; append NDJSON mirror (`telemetrySchemaVersion` / `lifecycleSchemaVersion` **10**); optional **`sessionForkGeneration`**, **`wave9ProbeId`**, **`wave10ProbeId`**, **`wave11ProbeId`**, **`bareModuleProbeClass`**, **`bareRpcProbeClass`**; optional correlation via **`BARE_OS_BOOT_ATTEMPT_ID`** → **`bootAttemptId`**                                                                                                                                                                     |
+| Telemetry OTel        | `BARE_OS_TELEMETRY_OTEL_JSONL`                                                         | Logical path; append OTLP-inspired JSON lines (`otlSchemaVersion` **8**, optional **`scopeMetrics`** sketch; see [`otel-bare-os-jsonl.schema.json`](../schemas/otel-bare-os-jsonl.schema.json))                                                                                                                                                                                      |
 | Proc poll             | `BARE_OS_PROC_POLL_MS`                                                                 | Min interval 250ms, max 60s, for coalesced **`/proc/bare_os/metrics_live.json`**                                                                                                                                                                                                                                                                                                      |
 | Shell `${…}`          | `BARE_OS_SHELL_PARAM_EXPANSION=1`                                                      | Enable `${VAR:-default}` and `${VAR#prefix}` (bounded prefix length)                                                                                                                                                                                                                                                                                                                  |
 | Shell `${…}` v2       | `BARE_OS_SHELL_PARAM_EXPANSION_V2=1`                                                   | With param expansion on: `${VAR:=x}`, `${VAR##*/}` / `${VAR#*/}`, `${VAR%%pat}` / `${VAR%pat}` (bounded; see handbook ch.9)                                                                                                                                                                                                                                                           |
@@ -72,6 +74,7 @@ Seed RPC **`bare_os.capabilities`** includes **`protocolPackageVersion`**, optio
 | Seeder staging        | `BARE_OS_SEED_STAGING_PREVIOUS_SLOT`, `BARE_OS_SEED_REPLICATION_QUEUE_DEPTH_HINT`, `BARE_OS_SEED_REPLICATION_SNAPSHOT_NOTE_JSON` | Seeder-only env for richer RPC payloads                                                                                                                                                                                                                                                                                                                                               |
 | Sandbox               | `BARE_OS_SANDBOX_WORKER=1`                                                             | Try `bare-worker` when available; else microtask defer                                                                                                                                                                                                                                                                                                                                |
 | Bundle tier           | `BARE_OS_BUNDLE_TIER=core`                                                             | `bare-os-bare-libs` build: only manifest rows with matching `tier` (`all` = default); optional per-row `risk` in manifest                                                                                                                                                                                                                                                             |
+| Wave 11 proc          | `BARE_OS_WAVE11_PROC=0` (or `false` / `off`)                                            | Hides the 20 Wave 11 **`/proc/bare_os_*.json`** entries, matching **`/proc/bare_os/*.json`** aliases, and their rows in **`/proc/bare_os/index.json`**; reads resolve as absent (**`null`** / ENOENT semantics)                                                                                                                                                                        |

 ## Wave 6 summary

@@ -85,6 +88,10 @@ Shipped as **`bits9`** + **`STOCK_V9`**. Word 9 map: [kernel-capabilities-index.

 Shipped as **`bits10`** + **`STOCK_V10`**. Word 10 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 10 table). CI: **`verify-kernel-roadmap-wave10.mjs`** plus the wave 3 / ctx / compat scripts above.

+## Wave 11 summary
+
+Shipped as **`bits11`** + **`STOCK_V11`**. Word 11 map: [kernel-capabilities-index.md](./kernel-capabilities-index.md). Checklist: [feature-roadmap.md](./feature-roadmap.md) (Wave 11 table). Node→Bare map: [node-to-bare-modules.md](../../developer-guide/node-to-bare-modules.md). CI: **`verify-kernel-roadmap-wave11.mjs`** plus **`verify-kernel-roadmap-wave3.mjs`**, **`verify-ctx-api-feature-bits.mjs`**, **`verify-ctx-dts.mjs`**, **`verify-compat-matrix.mjs`**.
+
 ## POSIX utility notes

 | Utility | Notes                                                |
@@ -9,7 +9,7 @@ Former **DOCUMENTATION.md** §10. [Reference index →](README.md)
 | Item                        | Detail                                                                     |
 | --------------------------- | -------------------------------------------------------------------------- |
 | `name`                      | `bare-os-protocol`                                                         |
-| `version`                   | `0.6.0` (wave 10: **`bits10`**, Pear/Bare seed RPC wave 10 + replication v5/v4 adjuncts + `compact_ping_v4`; couple boot policy **`requireProtocolPackageMin`** to this semver) |
+| `version`                   | `0.7.0` (wave 11: **`bits11`**, twenty new seed RPCs through **`mirror_drive_compaction_v6`**, **`compact_ping_v5`**; couple boot policy **`requireProtocolPackageMin`** to this semver) |
 | `main` / `exports["."]`     | `./index.js`                                                               |
 | `exports["./constants.js"]` | `./constants.js` (for `bare-os-protocol/constants.js` imports)             |
 | `exports["./messages"]`     | `./lib/messages.js`                                                        |
@@ -28,7 +28,7 @@ Re-exports from `./lib/channel.js`: `setupSeedChannel`.

 Re-exports from `./lib/seed-rpc-methods.js`: `BARE_OS_SEED_RPC_METHODS`, `BARE_OS_SEED_RPC_METHOD_SHORT_NAMES`, `BARE_OS_SEED_RPC_METHOD_SHORT_NAME_SET`.

-Re-exports **`STOCK_V5`**–**`STOCK_V9`** and **`BARE_OS_FEATURE5_*`** … **`FEATURE9_*`** from `./lib/kernel-feature-bits.js` (alongside earlier stock words). **`BARE_OS_PROTOCOL_PACKAGE_VERSION`** is published from `./lib/protocol-meta.js` for **`ctx.bareOsProtocolPackageVersion`** comparisons.
+Re-exports **`STOCK_V5`**–**`STOCK_V11`** and **`BARE_OS_FEATURE5_*`** … **`FEATURE11_*`** from `./lib/kernel-feature-bits.js` (alongside earlier stock words). **`BARE_OS_PROTOCOL_PACKAGE_VERSION`** is published from `./lib/protocol-meta.js` for **`ctx.bareOsProtocolPackageVersion`** comparisons.

 ### 10.3 [packages/bare-os-protocol/constants.js](../../packages/bare-os-protocol/constants.js)

@@ -18,6 +18,11 @@
    "requireFeatureBits8": { "type": "integer", "minimum": 0 },
    "requireFeatureBits9": { "type": "integer", "minimum": 0 },
    "requireFeatureBits10": { "type": "integer", "minimum": 0 },
+    "requireFeatureBits11": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Mask checked against ctx.bareOsAdvertisedKernelBits11 (wave 11)"
+    },
    "requireBareBootMin": {
      "type": "string",
      "description": "Minimum bare-boot semver vs BARE_OS_BARE_BOOT_VERSION"
@@ -32,6 +37,12 @@
      "minimum": 0,
      "maximum": 64
    },
+    "maxHrpcAllowlistDepth": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 64,
+      "description": "Cap nested HRPC allowlist probe depth; merged to BARE_OS_BOOT_POLICY_MAX_HRPC_ALLOWLIST_DEPTH"
+    },
    "requireBareLoggerMin": {
      "type": "string",
      "description": "Minimum bare-logger API class vs BARE_OS_BARE_LOGGER_VERSION"
@@ -44,14 +55,31 @@
      "type": "string",
      "description": "Minimum bare-tls semver vs BARE_OS_BARE_TLS_VERSION"
    },
+    "requireBarePackMin": {
+      "type": "string",
+      "description": "Minimum bare-pack semver vs BARE_OS_BARE_PACK_VERSION (host-supplied)"
+    },
+    "requireBareAddonPolicyMin": {
+      "type": "string",
+      "description": "Minimum bare-addon policy semver vs BARE_OS_BARE_ADDON_POLICY_VERSION (host-supplied sketch)"
+    },
    "extensionSignerPinsV3": {
      "type": "object",
      "additionalProperties": { "type": "string" }
    },
+    "extensionSignerPinsV4": {
+      "type": "object",
+      "additionalProperties": { "type": "string" },
+      "description": "Optional fourth extension signer pin map (wave 11); merged to BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V4_JSON"
+    },
    "offlineLkgRequirePearStamp": {
      "type": "boolean",
      "description": "When true, sets BARE_OS_OFFLINE_LKG_REQUIRE_PEAR_STAMP=1 for host/offline stamp class hints"
    },
+    "offlineLkgRequireBits11": {
+      "type": "boolean",
+      "description": "When true, sets BARE_OS_OFFLINE_LKG_REQUIRE_BITS11=1 for strict offline bits11 class hints"
+    },
    "bootPhasesRequireLifecycleMinSchema": {
      "type": "integer",
      "minimum": 0,
@@ -1,7 +1,7 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://bare-os.dev/schemas/kernel-extensions.registry.schema.json",
-  "title": "Bare OS /proc/bare_os/extensions.json (schema v2–v5)",
+  "title": "Bare OS /proc/bare_os/extensions.json (schema v2–v8)",
  "oneOf": [
    {
      "type": "object",
@@ -65,6 +65,44 @@
        },
        "atMs": { "type": "integer", "minimum": 0 }
      }
+    },
+    {
+      "type": "object",
+      "required": ["schema", "entries"],
+      "additionalProperties": true,
+      "properties": {
+        "schema": { "type": "integer", "const": 8 },
+        "featureBitsDoc": { "type": "integer", "minimum": 0 },
+        "extensionSignerPinsV4Note": {
+          "type": "string",
+          "maxLength": 256,
+          "description": "Optional operator note correlating boot.policy extensionSignerPinsV4 (wave 11)"
+        },
+        "entries": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["dropin", "script", "atMs"],
+            "additionalProperties": true,
+            "properties": {
+              "dropin": { "type": "string" },
+              "script": { "type": "string" },
+              "semver": { "type": "string" },
+              "capabilities": {
+                "type": "array",
+                "items": { "type": "string" },
+                "maxItems": 32
+              },
+              "compatPearBundleId": {
+                "type": "string",
+                "maxLength": 256
+              },
+              "atMs": { "type": "integer", "minimum": 0 }
+            }
+          }
+        },
+        "atMs": { "type": "integer", "minimum": 0 }
+      }
    }
  ]
 }
@@ -6,7 +6,7 @@
  "required": ["otlSchemaVersion", "resourceLogs"],
  "additionalProperties": true,
  "properties": {
-    "otlSchemaVersion": { "type": "integer", "enum": [4, 5, 6, 7] },
+    "otlSchemaVersion": { "type": "integer", "enum": [4, 5, 6, 7, 8] },
    "scopeMetrics": {
      "type": "array",
      "description": "Optional OTel-style scope metrics sketch (schema v5+)",
@@ -1,7 +1,7 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://bare-os.dev/schemas/telemetry-ndjson-record.schema.json",
-  "title": "Bare OS telemetry NDJSON line (lifecycle v7)",
+  "title": "Bare OS telemetry NDJSON line (lifecycle v10)",
  "type": "object",
  "required": ["type", "ts"],
  "additionalProperties": true,
@@ -22,6 +22,11 @@
      "type": "integer",
      "minimum": 0,
      "description": "Optional fork generation counter for nested sessions (wave 8)"
+    },
+    "wave11ProbeId": {
+      "type": "string",
+      "maxLength": 128,
+      "description": "Optional operator probe id when BARE_OS_WAVE11_PROBE_ID is set (wave 11)"
    }
  }
 }
@@ -12,14 +12,20 @@
  "requireFeatureBits8": 0,
  "requireFeatureBits9": 0,
  "requireFeatureBits10": 0,
+  "requireFeatureBits11": 0,
  "requireBareBootMin": "0.0.0",
  "denyBareRpcMethodPatterns": [],
  "maxPearInspectDepth": 0,
+  "maxHrpcAllowlistDepth": 0,
  "requireBareLoggerMin": "0.0.0",
  "denyAutobaseDiscoveryChannels": [],
  "requireBareTlsMin": "0.0.0",
+  "requireBarePackMin": "0.0.0",
+  "requireBareAddonPolicyMin": "0.0.0",
  "extensionSignerPinsV3": {},
+  "extensionSignerPinsV4": {},
  "offlineLkgRequirePearStamp": false,
+  "offlineLkgRequireBits11": false,
  "bootPhasesRequireLifecycleMinSchema": 0,
  "requireBareRuntimeMin": "0.0.0",
  "denySeedRpcMethods": [],
@@ -1,5 +1,5 @@
 {
-  "otlSchemaVersion": 7,
+  "otlSchemaVersion": 8,
  "scopeMetrics": [
    {
      "scope": { "name": "bare-os-example" },
@@ -1,6 +1,6 @@
 {
-  "telemetrySchemaVersion": 7,
-  "lifecycleSchemaVersion": 7,
+  "telemetrySchemaVersion": 10,
+  "lifecycleSchemaVersion": 10,
  "type": "boot",
  "ts": 0,
  "sessionId": "example-session",
@@ -130,6 +130,8 @@ function shouldSkipBootPhase(ctx, phase) {
 * Boot policy v10 (optional): `requireFeatureBits10`, `requireBareBootMin`, `denyBareRpcMethodPatterns`,
 *   `maxPearInspectDepth`, `requireBareLoggerMin`, `denyAutobaseDiscoveryChannels`, `requireBareTlsMin`,
 *   `extensionSignerPinsV3`, `offlineLkgRequirePearStamp`, `bootPhasesRequireLifecycleMinSchema`.
+ * Boot policy v11 (optional): `requireFeatureBits11`, `extensionSignerPinsV4`, `requireBarePackMin`,
+ *   `requireBareAddonPolicyMin`, `maxHrpcAllowlistDepth`, `offlineLkgRequireBits11`.
 * @param {Record<string, unknown>} ctx
 * @returns {Promise<boolean>} false when strict policy fails (caller should abort boot)
 */
@@ -382,6 +384,24 @@ async function applyBootPolicyFile(ctx) {
        }
      }
    }
+    if (
+      typeof pol.requireFeatureBits11 === 'number' &&
+      pol.requireFeatureBits11 > 0
+    ) {
+      const adv11 = ctx.bareOsAdvertisedKernelBits11
+      const need11 = pol.requireFeatureBits11 >>> 0
+      const ok =
+        typeof adv11 === 'number' && ((adv11 >>> 0) & need11) === need11
+      if (!ok) {
+        console.error('[boot-policy] requireFeatureBits11 not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
    if (
      pol.requirePearRuntimeRange &&
      typeof pol.requirePearRuntimeRange === 'object'
@@ -601,8 +621,15 @@ async function applyBootPolicyFile(ctx) {
      const parts = pol.denySeedRpcMethods
        .map((m) => String(m).trim())
        .filter(Boolean)
-      if (parts.length) {
-        ctx.env.BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS = parts.join(',')
+      const existing = String(
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS || ''
+      )
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean)
+      const merged = [...new Set([...existing, ...parts])]
+      if (merged.length) {
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS = merged.join(',')
      }
    }
    if (
@@ -687,6 +714,18 @@ async function applyBootPolicyFile(ctx) {
        /* ignore */
      }
    }
+    if (
+      pol.extensionSignerPinsV4 &&
+      typeof pol.extensionSignerPinsV4 === 'object' &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V4_JSON =
+          JSON.stringify(pol.extensionSignerPinsV4)
+      } catch {
+        /* ignore */
+      }
+    }
    if (
      typeof pol.requireBareBootMin === 'string' &&
      String(pol.requireBareBootMin).trim()
@@ -725,6 +764,15 @@ async function applyBootPolicyFile(ctx) {
        Math.min(64, Math.floor(pol.maxPearInspectDepth))
      )
    }
+    if (
+      typeof pol.maxHrpcAllowlistDepth === 'number' &&
+      pol.maxHrpcAllowlistDepth >= 0 &&
+      ctx.env
+    ) {
+      ctx.env.BARE_OS_BOOT_POLICY_MAX_HRPC_ALLOWLIST_DEPTH = String(
+        Math.min(64, Math.floor(pol.maxHrpcAllowlistDepth))
+      )
+    }
    if (
      typeof pol.requireBareLoggerMin === 'string' &&
      String(pol.requireBareLoggerMin).trim()
@@ -772,9 +820,49 @@ async function applyBootPolicyFile(ctx) {
        }
      }
    }
+    if (
+      typeof pol.requireBarePackMin === 'string' &&
+      String(pol.requireBarePackMin).trim()
+    ) {
+      const needS = String(pol.requireBarePackMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_PACK_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBarePackMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (
+      typeof pol.requireBareAddonPolicyMin === 'string' &&
+      String(pol.requireBareAddonPolicyMin).trim()
+    ) {
+      const needS = String(pol.requireBareAddonPolicyMin).trim()
+      const haveS =
+        ctx.env &&
+        String(ctx.env.BARE_OS_BARE_ADDON_POLICY_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareAddonPolicyMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
    if (pol.offlineLkgRequirePearStamp === true && ctx.env) {
      ctx.env.BARE_OS_OFFLINE_LKG_REQUIRE_PEAR_STAMP = '1'
    }
+    if (pol.offlineLkgRequireBits11 === true && ctx.env) {
+      ctx.env.BARE_OS_OFFLINE_LKG_REQUIRE_BITS11 = '1'
+    }
    if (
      typeof pol.offlineLkgManifestMaxAgeSec === 'number' &&
      pol.offlineLkgManifestMaxAgeSec > 0 &&
@@ -1039,9 +1127,19 @@ async function bootTimed(ctx, label, fn, phaseLog) {
        sessionId: sid,
        ts: Date.now()
      }
+      const w11 = ctx.env && String(ctx.env.BARE_OS_WAVE11_PROBE_ID || '').trim()
+      if (w11) rec.wave11ProbeId = w11.slice(0, 128)
+      const bp = ctx.env && String(ctx.env.BARE_OS_BARE_PACK_VERSION || '').trim()
+      if (bp) rec.barePackVersionHint = bp.slice(0, 64)
+      const ap = ctx.env &&
+        String(ctx.env.BARE_OS_BARE_ADDON_POLICY_VERSION || '').trim()
+      if (ap) rec.bareAddonPolicyVersionHint = ap.slice(0, 64)
      ctx.console.error(JSON.stringify(rec))
    } else if (isBootTraceJson(ctx)) {
-      ctx.console.error(JSON.stringify({ phase: label, ms }))
+      const base = { phase: label, ms }
+      const w11 = ctx.env && String(ctx.env.BARE_OS_WAVE11_PROBE_ID || '').trim()
+      if (w11) base.wave11ProbeId = w11.slice(0, 128)
+      ctx.console.error(JSON.stringify(base))
    } else {
      ctx.console.error(`[boot] ${label}: ${ms}ms`)
    }
@@ -19,12 +19,6 @@
        "hypercoreIdEncoding"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/compactEncoding.js",
-      "keys": [
-        "compactEncoding"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareUrl.js",
      "keys": [
@@ -32,15 +26,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/protomux.js",
+      "path": "/lib/bare/bundles/compactEncoding.js",
      "keys": [
-        "protomux"
+        "compactEncoding"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareEvents.js",
+      "path": "/lib/bare/bundles/protomux.js",
      "keys": [
-        "bareEvents"
+        "protomux"
      ]
    },
    {
@@ -55,6 +49,12 @@
        "barePath"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareEvents.js",
+      "keys": [
+        "bareEvents"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareAbort.js",
      "keys": [
@@ -67,18 +67,6 @@
        "bareAbortController"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAddonResolve.js",
-      "keys": [
-        "bareAddonResolve"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareReadline.js",
      "keys": [
@@ -92,9 +80,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareApk.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
      "keys": [
-        "bareApk"
+        "bareAnsiEscapes"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAddonResolve.js",
+      "keys": [
+        "bareAddonResolve"
      ]
    },
    {
@@ -109,18 +103,24 @@
        "bareAppKit"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAssert.js",
-      "keys": [
-        "bareAssert"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareAsyncHooks.js",
      "keys": [
        "bareAsyncHooks"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAssert.js",
+      "keys": [
+        "bareAssert"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareAtomics.js",
      "keys": [
@@ -133,6 +133,12 @@
        "bareBmp"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "keys": [
+        "bareBundleCompile"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareBundle.js",
      "keys": [
@@ -152,9 +158,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "path": "/lib/bare/bundles/bareBoot.js",
      "keys": [
-        "bareBundleCompile"
+        "bareBoot"
      ]
    },
    {
@@ -163,12 +169,6 @@
        "bareBundleEvaluate"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareBoot.js",
-      "keys": [
-        "bareBoot"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareConsole.js",
      "keys": [
@@ -206,9 +206,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareEnv.js",
+      "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
      "keys": [
-        "bareEnv"
+        "bareDiagnosticsChannel"
      ]
    },
    {
@@ -217,12 +217,6 @@
        "bareDns"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
-      "keys": [
-        "bareDiagnosticsChannel"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareCov.js",
      "keys": [
@@ -230,9 +224,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDgram.js",
+      "path": "/lib/bare/bundles/bareEnv.js",
      "keys": [
-        "bareDgram"
+        "bareEnv"
      ]
    },
    {
@@ -242,9 +236,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "path": "/lib/bare/bundles/bareDgram.js",
      "keys": [
-        "bareFfmpeg"
+        "bareDgram"
      ]
    },
    {
@@ -254,21 +248,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareFormat.js",
+      "path": "/lib/bare/bundles/bareFfmpeg.js",
      "keys": [
-        "bareFormat"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFormData.js",
-      "keys": [
-        "bareFormData"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
+        "bareFfmpeg"
      ]
    },
    {
@@ -277,12 +259,36 @@
        "bareGif"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFormat.js",
+      "keys": [
+        "bareFormat"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFileLogger.js",
+      "keys": [
+        "bareFileLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFormData.js",
+      "keys": [
+        "bareFormData"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareHeif.js",
      "keys": [
        "bareHeif"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFs.js",
+      "keys": [
+        "bareFs"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareGtk.js",
      "keys": [
@@ -307,24 +313,12 @@
        "bareIco"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareFs.js",
-      "keys": [
-        "bareFs"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareImageResample.js",
      "keys": [
        "bareImageResample"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareHttp1.js",
-      "keys": [
-        "bareHttp1"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareInspect.js",
      "keys": [
@@ -332,15 +326,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareHttps.js",
+      "path": "/lib/bare/bundles/bareHttp1.js",
      "keys": [
-        "bareHttps"
+        "bareHttp1"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareJpeg.js",
+      "path": "/lib/bare/bundles/bareHttps.js",
      "keys": [
-        "bareJpeg"
+        "bareHttps"
      ]
    },
    {
@@ -350,15 +344,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareIpc.js",
+      "path": "/lib/bare/bundles/bareJpeg.js",
      "keys": [
-        "bareIpc"
+        "bareJpeg"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareLief.js",
+      "path": "/lib/bare/bundles/bareIpc.js",
      "keys": [
-        "bareLief"
+        "bareIpc"
      ]
    },
    {
@@ -373,12 +367,24 @@
        "bareInspector"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareLief.js",
+      "keys": [
+        "bareLief"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareLink.js",
      "keys": [
        "bareLink"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareMake.js",
      "keys": [
@@ -409,12 +415,6 @@
        "bareModuleTraverse"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareNdk.js",
      "keys": [
@@ -428,15 +428,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareMedia.js",
+      "path": "/lib/bare/bundles/bareNative.js",
      "keys": [
-        "bareMedia"
+        "bareNative"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareOpen.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
      "keys": [
-        "bareOpen"
+        "bareMedia"
      ]
    },
    {
@@ -445,30 +445,30 @@
        "bareOs"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareOpen.js",
+      "keys": [
+        "bareOpen"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareNet.js",
      "keys": [
        "bareNet"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/barePerformance.js",
-      "keys": [
-        "barePerformance"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePipe.js",
-      "keys": [
-        "barePipe"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/barePack.js",
      "keys": [
        "barePack"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePerformance.js",
+      "keys": [
+        "barePerformance"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePackDrive.js",
      "keys": [
@@ -482,21 +482,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/barePunycode.js",
+      "path": "/lib/bare/bundles/barePipe.js",
      "keys": [
-        "barePunycode"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePrebuild.js",
-      "keys": [
-        "barePrebuild"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
-      "keys": [
-        "bareNodeRuntime"
+        "barePipe"
      ]
    },
    {
@@ -505,6 +493,12 @@
        "bareQuerystring"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePunycode.js",
+      "keys": [
+        "barePunycode"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
      "keys": [
@@ -512,9 +506,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareProcess.js",
+      "path": "/lib/bare/bundles/barePrebuild.js",
      "keys": [
-        "bareProcess"
+        "barePrebuild"
      ]
    },
    {
@@ -523,6 +517,12 @@
        "bareRealm"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePromClient.js",
      "keys": [
@@ -530,9 +530,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDev.js",
+      "path": "/lib/bare/bundles/bareProcess.js",
      "keys": [
-        "bareDev"
+        "bareProcess"
      ]
    },
    {
@@ -542,9 +542,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSdl.js",
+      "path": "/lib/bare/bundles/bareRepl.js",
      "keys": [
-        "bareSdl"
+        "bareRepl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareRpc.js",
+      "keys": [
+        "bareRpc"
      ]
    },
    {
@@ -553,6 +559,12 @@
        "bareSemver"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareSdl.js",
+      "keys": [
+        "bareSdl"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareRun.js",
      "keys": [
@@ -565,36 +577,12 @@
        "bareSidecar"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareRpc.js",
-      "keys": [
-        "bareRpc"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRepl.js",
-      "keys": [
-        "bareRepl"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareSignals.js",
      "keys": [
        "bareSignals"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareStringDecoder.js",
-      "keys": [
-        "bareStringDecoder"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStorage.js",
-      "keys": [
-        "bareStorage"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareStream.js",
      "keys": [
@@ -602,15 +590,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareStorage.js",
      "keys": [
-        "bareSvg"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStructuredClone.js",
-      "keys": [
-        "bareStructuredClone"
+        "bareStorage"
      ]
    },
    {
@@ -620,15 +602,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareStringDecoder.js",
      "keys": [
-        "bareSystemLogger"
+        "bareStringDecoder"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "path": "/lib/bare/bundles/bareSvg.js",
      "keys": [
-        "bareSubprocess"
+        "bareSvg"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "keys": [
+        "bareSystemLogger"
      ]
    },
    {
@@ -638,15 +626,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTiff.js",
+      "path": "/lib/bare/bundles/bareSubprocess.js",
      "keys": [
-        "bareTiff"
+        "bareSubprocess"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTimers.js",
+      "path": "/lib/bare/bundles/bareStructuredClone.js",
      "keys": [
-        "bareTimers"
+        "bareStructuredClone"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTiff.js",
+      "keys": [
+        "bareTiff"
      ]
    },
    {
@@ -655,12 +649,6 @@
        "bareThread"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareTpl.js",
-      "keys": [
-        "bareTpl"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareTcp.js",
      "keys": [
@@ -668,9 +656,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareTpl.js",
      "keys": [
-        "bareTls"
+        "bareTpl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTimers.js",
+      "keys": [
+        "bareTimers"
      ]
    },
    {
@@ -680,9 +674,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTty.js",
+      "path": "/lib/bare/bundles/bareTls.js",
      "keys": [
-        "bareTty"
+        "bareTls"
      ]
    },
    {
@@ -698,15 +692,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareV8.js",
+      "path": "/lib/bare/bundles/bareTty.js",
      "keys": [
-        "bareV8"
+        "bareTty"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareVm.js",
+      "path": "/lib/bare/bundles/bareV8.js",
      "keys": [
-        "bareVm"
+        "bareV8"
      ]
    },
    {
@@ -722,9 +716,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
+      "path": "/lib/bare/bundles/bareVm.js",
      "keys": [
-        "bareWebKit"
+        "bareVm"
      ]
    },
    {
@@ -733,6 +727,24 @@
        "bareWebKitGtk"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareUtils.js",
+      "keys": [
+        "bareUtils"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
+      "keys": [
+        "bareV8ToIstanbul"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareWebp.js",
      "keys": [
@@ -745,18 +757,6 @@
        "bareWhich"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
-      "keys": [
-        "bareV8ToIstanbul"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUtils.js",
-      "keys": [
-        "bareUtils"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWinUi.js",
      "keys": [
@@ -781,17 +781,17 @@
        "bareZmq"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareWs.js",
-      "keys": [
-        "bareWs"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWorker.js",
      "keys": [
        "bareWorker"
      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
    }
  ],
  "bundleStats": {
@@ -14,7 +14,7 @@
    "gen:bare-catalog:check": "node scripts/gen-bare-holepunch-catalog.mjs --check",
    "sync:bare-manifest": "node scripts/sync-bare-module-manifest-from-catalog.mjs",
    "smoke:bare-manifest": "node scripts/smoke-bare-manifest-imports.mjs",
-    "pretest": "npm run build -w bare-os-coreutils && npm run build -w bare-os-bare-libs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-roadmap-wave3.mjs && node scripts/verify-kernel-roadmap-wave6.mjs && node scripts/verify-kernel-roadmap-wave7.mjs && node scripts/verify-kernel-roadmap-wave8.mjs && node scripts/verify-kernel-roadmap-wave9.mjs && node scripts/verify-kernel-roadmap-wave10.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-pear-no-static-node-import.mjs && npm run smoke:bare-manifest",
+    "pretest": "npm run build -w bare-os-coreutils && npm run build -w bare-os-bare-libs && node scripts/verify-kernel-seeder-parity.mjs && node scripts/verify-ctx-api-feature-bits.mjs && node scripts/verify-kernel-roadmap-wave3.mjs && node scripts/verify-kernel-roadmap-wave6.mjs && node scripts/verify-kernel-roadmap-wave7.mjs && node scripts/verify-kernel-roadmap-wave8.mjs && node scripts/verify-kernel-roadmap-wave9.mjs && node scripts/verify-kernel-roadmap-wave10.mjs && node scripts/verify-kernel-roadmap-wave11.mjs && node scripts/verify-ctx-dts.mjs && node scripts/validate-example-schemas.mjs && node scripts/verify-doc-links.mjs && node scripts/verify-man-coverage.mjs && node scripts/verify-compat-matrix.mjs && node scripts/verify-pear-no-static-node-import.mjs && npm run smoke:bare-manifest",
    "test": "npm run test --workspaces --if-present",
    "verify-kernel-seeder": "node scripts/verify-kernel-seeder-parity.mjs",
    "release-checklist": "node scripts/release-checklist.mjs",
@@ -8,6 +8,7 @@

 | Version | Booter (workspace) | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | ------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 1.20.0  | 0.1.0              | Eleventh word **`bits11`** + **`STOCK_V11`**; seed **`bits11`** + strict check; Wave 11 **`/proc`** JSON (**`bare-os-wave11-proc.js`**), **`bare_os_proc_index`** schema **7**, **`extensions.json`** schema **8**; boot policy v11 keys (**`requireFeatureBits11`**, **`extensionSignerPinsV4`**, **`requireBarePackMin`**, **`requireBareAddonPolicyMin`**, **`maxHrpcAllowlistDepth`**, **`offlineLkgRequireBits11`**, merged **`denySeedRpcMethods`**); NDJSON lifecycle **10**, OTel **`otlSchemaVersion: 8`**, audit **`auditSchemaVersion: 8`**; **`cryptoproc:*`** / **`indexerproc:*`** worker patterns; **`ctx`** wave 11 stubs; **`wave11ProbeId`**, **`BARE_OS_BARE_PACK_VERSION`**, **`BARE_OS_BARE_ADDON_POLICY_VERSION`**. Protocol **`0.7.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=13`**. CI: **`verify-kernel-roadmap-wave11.mjs`**. |
 | 1.19.0  | 0.1.0              | Tenth word **`bits10`** + **`STOCK_V10`**; seed **`bits10`** + strict check; Wave 10 **`/proc`** JSON (**`bare-os-wave10-proc.js`**), **`bare_os_proc_index`** schema **6**, **`extensions.json`** schema **7**; boot policy v10 keys; NDJSON lifecycle **9**, OTel **`otlSchemaVersion: 7`**, audit **`auditSchemaVersion: 7`**; **`sysproc:*`** worker group; **`ctx`** wave 10 Pear/Bare stubs; telemetry **`wave10ProbeId`**, **`bareRpcProbeClass`**, **`BARE_OS_LIFECYCLE_SCHEMA_VERSION`** in guest env. Protocol **`0.6.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=12`**. CI: **`verify-kernel-roadmap-wave10.mjs`**. |
 | 1.18.0  | 0.1.0              | Ninth word **`bits9`** + **`STOCK_V9`**; seed **`bits9`** + strict check; Wave 9 **`/proc`** JSON (**`bare-os-wave9-proc.js`**), **`bare_os_proc_index`** schema **5**, **`extensions.json`** schema **6**; boot policy v9 keys in **`boot.policy.json`**; NDJSON lifecycle **8**, OTel **`otlSchemaVersion: 6`**, audit **`auditSchemaVersion: 6`**; **`mediaproc:*`** worker group; **`ctx`** wave 9 Pear/Bare stubs (**`bareOsEmitPearStageHint`**, probes, …); **`BARE_OS_SOCKS_PROXY_MAP_JSON`** lookup helper; telemetry **`wave9ProbeId`**. Protocol **`0.5.0`**, **`BARE_OS_KERNEL_FEATURE_BITS_DOC=11`**, extended **`seed-rpc-methods.js`**. CI: **`verify-kernel-roadmap-wave9.mjs`**. |
 | 1.15.0  | 0.1.0              | Sixth word **`bits6`** + **`STOCK_V6`**; seed **`bits6`** + strict check; Wave 6 **`/proc/bare_os/*.json`** operator metrics; **`bareOsAdvertisedKernelBits6`**, **`bareOsSeedCapabilityBits6`**, **`bareOsBooterPackageVersion`**; Pear hooks **`bareOsPearUpdaterDelegate`**, **`bareOsEmitHyperdhtBootstrapRefresh`**; subprocess snapshot schema **3**; boot policy v6 env (**`requireFeatureBits6`**, **`requireBooterSemver`**, **`requireCtxApiMin`**, extension deny/hash pins, offline LKG strict); NDJSON lifecycle **5**, OTel **`otlSchemaVersion: 3`**, audit **`auditSchemaVersion: 3`**; **`mathproc:*`**, **`BARE_OS_BIN_WORKER_WALL_MS`**; delegate **`hrpc`** stub; **`verify-kernel-roadmap-wave6.mjs`**, **`verify-pear-no-static-node-import.mjs`**. Protocol: **`BARE_OS_KERNEL_FEATURE_BITS_DOC=8`**, extended **`seed-rpc-methods.js`**. |
@@ -20,6 +20,7 @@ import {
  BARE_OS_KERNEL_FEATURES_STOCK_V8,
  BARE_OS_KERNEL_FEATURES_STOCK_V9,
  BARE_OS_KERNEL_FEATURES_STOCK_V10,
+  BARE_OS_KERNEL_FEATURES_STOCK_V11,
  BARE_OS_KERNEL_FEATURE_BITS_DOC,
  BARE_OS_FEATURE_CRYPTO_URANDOM,
  BARE_OS_PROTOCOL_PACKAGE_VERSION
@@ -37,6 +38,7 @@ import { createVfs } from './lib/vfs.js'
 import { buildBareOsWave8ProcJson } from './lib/bare-os-wave8-proc.js'
 import { buildBareOsWave9ProcJson } from './lib/bare-os-wave9-proc.js'
 import { buildBareOsWave10ProcJson } from './lib/bare-os-wave10-proc.js'
+import { buildBareOsWave11ProcJson } from './lib/bare-os-wave11-proc.js'
 import { createBareOsIpc } from './lib/bare-os-ipc.js'
 import {
  execShellLine,
@@ -476,12 +478,16 @@ async function executeKernel(disk, store, swarm, initSource) {
    'BARE_OS_BARE_BOOT_VERSION',
    'BARE_OS_BARE_LOGGER_VERSION',
    'BARE_OS_BARE_TLS_VERSION',
+    'BARE_OS_BARE_PACK_VERSION',
+    'BARE_OS_BARE_ADDON_POLICY_VERSION',
    'BARE_OS_PEAR_IPC_PACKAGE_VERSION',
    'BARE_OS_PEAR_UPDATER_CHANNEL',
    'BARE_OS_HAPPY_EYEBALLS_V3_MODE',
    'BARE_OS_BIN_WORKER_WASM_MS_MAX',
    'BARE_OS_WAVE9_PROBE_ID',
    'BARE_OS_WAVE10_PROBE_ID',
+    'BARE_OS_WAVE11_PROBE_ID',
+    'BARE_OS_WAVE11_PROC',
    'BARE_OS_BARE_RPC_PROBE_CLASS',
    'BARE_OS_MTLS_PROXY_MAP_JSON',
    'BARE_OS_THREAD_POOL_TELEMETRY_JSON',
@@ -690,6 +696,7 @@ async function executeKernel(disk, store, swarm, initSource) {
        bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
        bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
        bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
+        bits11: BARE_OS_KERNEL_FEATURES_STOCK_V11 >>> 0,
        bootTracePointer: 'stderr:BARE_OS_BOOT_TRACE',
        atMs: Date.now()
      })}\n`
@@ -727,6 +734,10 @@ async function executeKernel(disk, store, swarm, initSource) {
      const o = buildBareOsWave10ProcJson(String(wave10Id || ''), shellEnv)
      return `${JSON.stringify(o)}\n`
    },
+    procBareOsWave11JsonText(wave11Id) {
+      const o = buildBareOsWave11ProcJson(String(wave11Id || ''), shellEnv)
+      return `${JSON.stringify(o)}\n`
+    },
    hostProcStatsRef,
    procSnapshot: {
      version: BARE_OS_CTX_API_VERSION,
@@ -839,6 +850,7 @@ async function executeKernel(disk, store, swarm, initSource) {
            bits8: seed.bits8,
            bits9: seed.bits9,
            bits10: seed.bits10,
+            bits11: seed.bits11,
            role: seed.role,
            protocol: seed.protocol
          }
@@ -861,6 +873,7 @@ async function executeKernel(disk, store, swarm, initSource) {
        bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
        bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
        bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
+        bits11: BARE_OS_KERNEL_FEATURES_STOCK_V11 >>> 0,
        urandomCrypto: urandomCryptoOn,
        seedHandshake,
        protocolPackageVersion: protocolPackageVersion || undefined,
@@ -869,7 +882,7 @@ async function executeKernel(disk, store, swarm, initSource) {
    },
    procBareOsExtensionsText() {
      return `${JSON.stringify({
-        schema: 7,
+        schema: 8,
        featureBitsDoc: BARE_OS_KERNEL_FEATURE_BITS_DOC,
        entries: kernelExtensionRecords,
        atMs: Date.now()
@@ -1450,6 +1463,8 @@ async function executeKernel(disk, store, swarm, initSource) {
    BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0
  const bareOsAdvertisedKernelBits10Resolved =
    BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0
+  const bareOsAdvertisedKernelBits11Resolved =
+    BARE_OS_KERNEL_FEATURES_STOCK_V11 >>> 0

  /** @type {(() => void | Promise<void>)[]} */
  const bareOsSuspendHooks = []
@@ -1495,6 +1510,7 @@ async function executeKernel(disk, store, swarm, initSource) {
    bareOsAdvertisedKernelBits8: bareOsAdvertisedKernelBits8Resolved,
    bareOsAdvertisedKernelBits9: bareOsAdvertisedKernelBits9Resolved,
    bareOsAdvertisedKernelBits10: bareOsAdvertisedKernelBits10Resolved,
+    bareOsAdvertisedKernelBits11: bareOsAdvertisedKernelBits11Resolved,
    bareOsBooterPackageVersion: _BOOTER_PKG_VERSION,
    bareOsProtocolPackageVersion: BARE_OS_PROTOCOL_PACKAGE_VERSION,
    bareOsPearRuntimeVersion: String(
@@ -1563,6 +1579,12 @@ async function executeKernel(disk, store, swarm, initSource) {
      typeof disk.seedCapabilityInfo.bits10 === 'number'
        ? disk.seedCapabilityInfo.bits10 >>> 0
        : null,
+    bareOsSeedCapabilityBits11:
+      disk.seedCapabilityInfo &&
+      typeof disk.seedCapabilityInfo === 'object' &&
+      typeof disk.seedCapabilityInfo.bits11 === 'number'
+        ? disk.seedCapabilityInfo.bits11 >>> 0
+        : null,
    bareOsSystemRevision: Object.freeze({
      currentId: String(shellEnv.BARE_OS_SYSTEM_REVISION_ID || '').trim(),
      pendingId: String(shellEnv.BARE_OS_SYSTEM_REVISION_PENDING || '').trim(),
@@ -2511,6 +2533,186 @@ async function executeKernel(disk, store, swarm, initSource) {
        note: 'Terminal capability flags; host interprets pear-terminal class.'
      }
    },
+    bareOsEmitHypercoreReplicateBudget(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:hypercore-replicate-budget', {
+          budgetClass: String(payload.budgetClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsEmitDriveVersionGraph(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:drive-version-graph', {
+          graphClass: String(payload.graphClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsEmitProtomuxBackpressure(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:protomux-backpressure', {
+          depthClass: String(payload.depthClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsPearRuntimeMatrixProbe() {
+      return {
+        ok: false,
+        note: 'pear-runtime matrix; host may wire BARE_OS_PEAR_RUNTIME_MATRIX_JSON.'
+      }
+    },
+    bareOsBundlePreloadHint(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:bundle-preload-hint', {
+          bundleClass: String(payload.bundleClass || '').slice(0, 256),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsAutopassRotationSketch(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:autopass-rotation-sketch', {
+          rotationClass: String(payload.rotationClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsHrpcAllowlistProbe() {
+      return {
+        ok: false,
+        note: 'hrpc allowlist sketch; host-delegated when available.'
+      }
+    },
+    bareOsSidecarResourceCap(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:sidecar-resource-cap', {
+          capClass: String(payload.capClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsGitLfsBudgetProbe() {
+      return {
+        ok: false,
+        note: 'git LFS budget; see BARE_OS_GIT_LFS_BUDGET_JSON / seed RPC.'
+      }
+    },
+    bareOsNetQosClass(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:net-qos-class', {
+          qosClass: String(payload.qosClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsStorageTierHint(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:storage-tier-hint', {
+          tierClass: String(payload.tierClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsIndexerCatchupProbe() {
+      return {
+        ok: false,
+        note: 'Indexer catchup budget; host may wire BARE_OS_INDEXER_CATCHUP_JSON.'
+      }
+    },
+    bareOsMultisigQuorumPointer(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:multisig-quorum-pointer', {
+          pointerClass: String(payload.pointerClass || '').slice(0, 256),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsRelayGeoHint(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:relay-geo-hint', {
+          regionClass: String(payload.regionClass || '').slice(0, 64),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsBarePackCacheProbe() {
+      return {
+        ok: false,
+        note: 'bare-pack cache; see BARE_OS_BARE_PACK_CACHE_JSON.'
+      }
+    },
+    bareOsBareAddonPolicyProbe() {
+      return {
+        ok: false,
+        note: 'bare-addon policy; see BARE_OS_BARE_ADDON_POLICY_JSON.'
+      }
+    },
+    bareOsBareSignalsProfile(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:bare-signals-profile', {
+          profileClass: String(payload.profileClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
+    bareOsBareTimersHistogram(payload = {}) {
+      if (typeof globalThis.process?.emit !== 'function') return false
+      try {
+        globalThis.process.emit('bare-os:bare-timers-histogram', {
+          histClass: String(payload.histClass || '').slice(0, 128),
+          ts: Date.now()
+        })
+        return true
+      } catch {
+        return false
+      }
+    },
    /**
     * Optional hrpc round-trip; stock booter never leaves guest without host bridge.
     * @returns {Promise<unknown>}
@@ -2779,7 +2981,7 @@ async function executeKernel(disk, store, swarm, initSource) {
    const auditFn = auditOn
      ? (info) => {
          const line = JSON.stringify({
-            auditSchemaVersion: 7,
+            auditSchemaVersion: 8,
            type: 'httpFetch',
            ts: Date.now(),
            requestSmugglingClass: 'none',
@@ -2902,7 +3104,7 @@ async function executeKernel(disk, store, swarm, initSource) {
          AUDIT_LOG,
          'json',
          JSON.stringify({
-            auditSchemaVersion: 7,
+            auditSchemaVersion: 8,
            type: 'execLine',
            ts: Date.now(),
            requestSmugglingClass: 'none',
@@ -3072,6 +3274,7 @@ async function loadOsFromOfflineLkg(store, swarm, Hyperdrive, disk, splash, keyH
    bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
    bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
    bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
+    bits11: BARE_OS_KERNEL_FEATURES_STOCK_V11 >>> 0,
    protocol: 'bare-os-v1',
    note: 'offline boot; bare_os.capabilities RPC not used'
  }
@@ -3190,6 +3393,13 @@ async function loadOsFromPeers(disk, store, swarm, splash) {
            'BARE_OS_SEED_CAP_STRICT: seeder feature bits10 do not cover stock booter requirements'
          )
        }
+        const need11 = BARE_OS_KERNEL_FEATURES_STOCK_V11 >>> 0
+        const got11 = typeof cap.bits11 === 'number' ? cap.bits11 >>> 0 : 0
+        if (need11 !== 0 && (got11 & need11) !== need11) {
+          throw new Error(
+            'BARE_OS_SEED_CAP_STRICT: seeder feature bits11 do not cover stock booter requirements'
+          )
+        }
      }
      try {
        disk.seedReplicationStatus = await disk.rpc(
@@ -2,4 +2,4 @@
 * Semantic version of the booter `ctx` contract for custom kernels.
 * Bump when adding/removing/renaming documented `ctx` fields or changing behavior.
 */
-export const BARE_OS_CTX_API_VERSION = '1.19.0'
+export const BARE_OS_CTX_API_VERSION = '1.20.0'
@@ -97,6 +97,8 @@ export interface BareOsKernelContext {
  bareOsSeedCapabilityBits9?: number | null
  bareOsAdvertisedKernelBits10?: number
  bareOsSeedCapabilityBits10?: number | null
+  bareOsAdvertisedKernelBits11?: number
+  bareOsSeedCapabilityBits11?: number | null
  bareOsBooterPackageVersion?: string
  bareOsProtocolPackageVersion?: string
  bareOsPearRuntimeVersion?: string
@@ -230,6 +232,24 @@ export interface BareOsKernelContext {
  bareOsEmitBlindPairingSketch?(payload?: Record<string, unknown>): boolean
  bareOsBareStreamBackpressureHint?(payload?: Record<string, unknown>): boolean
  bareOsPearTerminalCapsProbe?(): { ok: boolean; note?: string }
+  bareOsEmitHypercoreReplicateBudget?(payload?: Record<string, unknown>): boolean
+  bareOsEmitDriveVersionGraph?(payload?: Record<string, unknown>): boolean
+  bareOsEmitProtomuxBackpressure?(payload?: Record<string, unknown>): boolean
+  bareOsPearRuntimeMatrixProbe?(): { ok: boolean; note?: string }
+  bareOsBundlePreloadHint?(payload?: Record<string, unknown>): boolean
+  bareOsAutopassRotationSketch?(payload?: Record<string, unknown>): boolean
+  bareOsHrpcAllowlistProbe?(): { ok: boolean; note?: string }
+  bareOsSidecarResourceCap?(payload?: Record<string, unknown>): boolean
+  bareOsGitLfsBudgetProbe?(): { ok: boolean; note?: string }
+  bareOsNetQosClass?(payload?: Record<string, unknown>): boolean
+  bareOsStorageTierHint?(payload?: Record<string, unknown>): boolean
+  bareOsIndexerCatchupProbe?(): { ok: boolean; note?: string }
+  bareOsMultisigQuorumPointer?(payload?: Record<string, unknown>): boolean
+  bareOsRelayGeoHint?(payload?: Record<string, unknown>): boolean
+  bareOsBarePackCacheProbe?(): { ok: boolean; note?: string }
+  bareOsBareAddonPolicyProbe?(): { ok: boolean; note?: string }
+  bareOsBareSignalsProfile?(payload?: Record<string, unknown>): boolean
+  bareOsBareTimersHistogram?(payload?: Record<string, unknown>): boolean
  bareOsHrpcRequest?(
    service: string,
    method: string,
@@ -2,7 +2,7 @@
 * Unified version for booter NDJSON telemetry, boot phase events, and var-log mirrors.
 * Bump when adding required fields or changing semantics (see docs/reference/kernel-extensions.md).
 */
-export const BARE_OS_LIFECYCLE_SCHEMA_VERSION = 9
+export const BARE_OS_LIFECYCLE_SCHEMA_VERSION = 10

 /** Legacy field still emitted for older parsers; prefer {@link BARE_OS_LIFECYCLE_SCHEMA_VERSION}. */
-export const BARE_OS_TELEMETRY_SCHEMA_VERSION = 9
+export const BARE_OS_TELEMETRY_SCHEMA_VERSION = 10
@@ -113,6 +113,7 @@ async function mirrorBareOsTelemetryNdjson(ctx, rec) {
    const bootAttemptId = String(env.BARE_OS_BOOT_ATTEMPT_ID || '').trim()
    const wave9ProbeId = String(env.BARE_OS_WAVE9_PROBE_ID || '').trim()
    const wave10ProbeId = String(env.BARE_OS_WAVE10_PROBE_ID || '').trim()
+    const wave11ProbeId = String(env.BARE_OS_WAVE11_PROBE_ID || '').trim()
    const line =
      JSON.stringify({
        telemetrySchemaVersion: BARE_OS_TELEMETRY_SCHEMA_VERSION,
@@ -121,6 +122,7 @@ async function mirrorBareOsTelemetryNdjson(ctx, rec) {
        bootAttemptId: bootAttemptId ? bootAttemptId.slice(0, 128) : undefined,
        wave9ProbeId: wave9ProbeId ? wave9ProbeId.slice(0, 128) : undefined,
        wave10ProbeId: wave10ProbeId ? wave10ProbeId.slice(0, 128) : undefined,
+        wave11ProbeId: wave11ProbeId ? wave11ProbeId.slice(0, 128) : undefined,
        bareRpcProbeClass: String(
          env.BARE_OS_BARE_RPC_PROBE_CLASS || ''
        )
@@ -171,7 +173,7 @@ async function mirrorBareOsOtelJsonl(ctx, eventName, attrs) {
    if (!vfs || typeof vfs.readFile !== 'function') return
    const line =
      JSON.stringify({
-        otlSchemaVersion: 7,
+        otlSchemaVersion: 8,
        resourceLogs: [
          {
            resource: {
@@ -0,0 +1,171 @@
+/**
+ * Wave 11 optional `/proc/bare_os/*.json` payloads (env-injected; bounded, non-secret).
+ * Aligns with seed RPC wave 11 + bits11 — no Node `node:*` built-ins in guest paths.
+ * @param {string} id
+ * @param {Record<string, string>} env
+ */
+export function buildBareOsWave11ProcJson(id, env) {
+  const now = Date.now()
+  const esc = (k) => String(env[k] ?? '').trim()
+
+  function parseJsonEnv(key) {
+    const raw = esc(key)
+    if (!raw) return null
+    try {
+      const o = JSON.parse(raw)
+      return o && typeof o === 'object' ? o : null
+    } catch {
+      return { schema: 1, error: 'invalid_json', key, atMs: now }
+    }
+  }
+
+  switch (id) {
+    case 'hypercore_replicate_budget':
+      return {
+        schema: 1,
+        budget: parseJsonEnv('BARE_OS_HYPERCORE_REPLICATE_BUDGET_JSON'),
+        note: 'hypercore replicate queue budget v2 sketch.',
+        atMs: now
+      }
+    case 'drive_version_graph':
+      return {
+        schema: 1,
+        graph: parseJsonEnv('BARE_OS_DRIVE_VERSION_GRAPH_JSON'),
+        note: 'multi-drive lineage graph pointer.',
+        atMs: now
+      }
+    case 'protomux_backpressure':
+      return {
+        schema: 1,
+        backpressure: parseJsonEnv('BARE_OS_PROTOMUX_BACKPRESSURE_JSON'),
+        note: 'protomux channel depth hints.',
+        atMs: now
+      }
+    case 'pear_runtime_matrix':
+      return {
+        schema: 1,
+        matrix: parseJsonEnv('BARE_OS_PEAR_RUNTIME_MATRIX_JSON'),
+        note: 'pear-runtime vs bare-runtime matrix.',
+        atMs: now
+      }
+    case 'bundle_preload_hint':
+      return {
+        schema: 1,
+        preload: parseJsonEnv('BARE_OS_BUNDLE_PRELOAD_HINT_JSON'),
+        note: 'cold-start bundle preload list.',
+        atMs: now
+      }
+    case 'autopass_rotation_sketch':
+      return {
+        schema: 1,
+        rotation: parseJsonEnv('BARE_OS_AUTOPASS_ROTATION_SKETCH_JSON'),
+        note: 'autopass rotation schedule class.',
+        atMs: now
+      }
+    case 'hrpc_allowlist_sketch':
+      return {
+        schema: 1,
+        allowlist: parseJsonEnv('BARE_OS_HRPC_ALLOWLIST_SKETCH_JSON'),
+        note: 'hrpc method allowlist sketch.',
+        atMs: now
+      }
+    case 'sidecar_resource_cap':
+      return {
+        schema: 1,
+        cap: parseJsonEnv('BARE_OS_SIDECAR_RESOURCE_CAP_JSON'),
+        note: 'sidecar CPU/memory class.',
+        atMs: now
+      }
+    case 'git_lfs_budget':
+      return {
+        schema: 1,
+        budget: parseJsonEnv('BARE_OS_GIT_LFS_BUDGET_JSON'),
+        note: 'git LFS bandwidth window.',
+        atMs: now
+      }
+    case 'net_qos_class':
+      return {
+        schema: 1,
+        qos: parseJsonEnv('BARE_OS_NET_QOS_CLASS_JSON'),
+        note: 'egress QoS class hint.',
+        atMs: now
+      }
+    case 'storage_tier_hint':
+      return {
+        schema: 1,
+        tier: parseJsonEnv('BARE_OS_STORAGE_TIER_HINT_JSON'),
+        note: 'storage hot/warm/cold pointer.',
+        atMs: now
+      }
+    case 'indexer_catchup':
+      return {
+        schema: 1,
+        catchup: parseJsonEnv('BARE_OS_INDEXER_CATCHUP_JSON'),
+        note: 'Hyperbee/HyperDB indexer lag budget.',
+        atMs: now
+      }
+    case 'multisig_quorum_pointer':
+      return {
+        schema: 1,
+        pointer: parseJsonEnv('BARE_OS_MULTISIG_QUORUM_POINTER_JSON'),
+        note: 'multisig quorum policy pointer only.',
+        atMs: now
+      }
+    case 'relay_geo_hint':
+      return {
+        schema: 1,
+        regions: parseJsonEnv('BARE_OS_RELAY_GEO_HINT_JSON'),
+        note: 'coarse relay region tags.',
+        atMs: now
+      }
+    case 'bare_pack_cache':
+      return {
+        schema: 1,
+        cache: parseJsonEnv('BARE_OS_BARE_PACK_CACHE_JSON'),
+        note: 'bare-pack / bare-pack-drive cache policy.',
+        atMs: now
+      }
+    case 'bare_addon_policy':
+      return {
+        schema: 1,
+        policy: parseJsonEnv('BARE_OS_BARE_ADDON_POLICY_JSON'),
+        note: 'native bare-addon policy sketch.',
+        atMs: now
+      }
+    case 'bare_signals_profile':
+      return {
+        schema: 1,
+        profile: parseJsonEnv('BARE_OS_BARE_SIGNALS_PROFILE_JSON'),
+        note: 'bare-signals mask summary.',
+        atMs: now
+      }
+    case 'bare_timers_histogram':
+      return {
+        schema: 1,
+        histogram: parseJsonEnv('BARE_OS_BARE_TIMERS_HISTOGRAM_JSON'),
+        note: 'bare-timers histogram (dev).',
+        atMs: now
+      }
+    case 'wave11_peer_qos_sketch':
+      return {
+        schema: 1,
+        sketch: parseJsonEnv('BARE_OS_WAVE11_PEER_QOS_SKETCH_JSON'),
+        note: 'wave11 peer QoS operator sketch.',
+        atMs: now
+      }
+    case 'wave11_operator_slo_v2':
+      return {
+        schema: 1,
+        slo: parseJsonEnv('BARE_OS_WAVE11_OPERATOR_SLO_V2_JSON'),
+        note: 'wave11 SLO hint adjunct.',
+        atMs: now
+      }
+    default:
+      return {
+        schema: 1,
+        error: 'unknown_wave11_proc',
+        id,
+        atMs: now
+      }
+  }
+}
@@ -125,6 +125,32 @@ export function loadBareOsHostDelegates() {
          new Error('archive delegate not implemented in stock booter (documentation placeholder)')
        )
      }
+    },
+    {
+      kind: 'sidecar',
+      describe: () => 'sidecar resource cap (wave 11 audit stub)',
+      shouldDelegate() {
+        return false
+      },
+      run() {
+        return Promise.reject(
+          new Error('sidecar delegate is audit-only; host wires bare-sidecar bridges')
+        )
+      }
+    },
+    {
+      kind: 'pear_runtime_matrix',
+      describe: () => 'pear-runtime matrix (wave 11 audit stub)',
+      shouldDelegate() {
+        return false
+      },
+      run() {
+        return Promise.reject(
+          new Error(
+            'pear_runtime_matrix delegate is audit-only; see ctx.bareOsPearRuntimeMatrixProbe'
+          )
+        )
+      }
    }
  ]
 }
@@ -49,6 +49,12 @@ const _BIN_WORKER_IOPROC = new Set(['cat', 'head', 'tail'])

 const _BIN_WORKER_MEDIAPROC = new Set(['ffmpeg', 'ffprobe'])

+/** Crypto-class `/bin` stubs (e.g. openssl) under `cryptoproc:*` (wave 11). */
+const _BIN_WORKER_CRYPTOPROC = new Set(['openssl'])
+
+/** Indexer-adjacent tools under `indexerproc:*` (wave 11; reserved; extend when `/bin` gains indexer helpers). */
+const _BIN_WORKER_INDEXERPROC = new Set([])
+
 /** Process/shell-adjacent builtins allowed under `sysproc:*` (documentary group; bare-process-class). */
 const _BIN_WORKER_SYSPROC = new Set([
  'pwd',
@@ -100,6 +106,14 @@ function binWorkerOffloadEnabled(cmd, env) {
      if (_BIN_WORKER_SYSPROC.has(cmd)) return true
      continue
    }
+    if (p === 'cryptoproc:*') {
+      if (_BIN_WORKER_CRYPTOPROC.has(cmd)) return true
+      continue
+    }
+    if (p === 'indexerproc:*') {
+      if (_BIN_WORKER_INDEXERPROC.has(cmd)) return true
+      continue
+    }
    if (p.endsWith(':*')) {
      const pre = p.slice(0, -2)
      if (pre === 'textproc' && _BIN_WORKER_TEXTPROC.has(cmd)) return true
@@ -107,6 +121,8 @@ function binWorkerOffloadEnabled(cmd, env) {
      if (pre === 'ioproc' && _BIN_WORKER_IOPROC.has(cmd)) return true
      if (pre === 'mediaproc' && _BIN_WORKER_MEDIAPROC.has(cmd)) return true
      if (pre === 'sysproc' && _BIN_WORKER_SYSPROC.has(cmd)) return true
+      if (pre === 'cryptoproc' && _BIN_WORKER_CRYPTOPROC.has(cmd)) return true
+      if (pre === 'indexerproc' && _BIN_WORKER_INDEXERPROC.has(cmd)) return true
      continue
    }
    if (p === cmd) return true
@@ -177,7 +193,7 @@ async function auditDelegateJson(ctx, kind, argv) {
    AUDIT_LOG,
    'json',
    JSON.stringify({
-      auditSchemaVersion: 7,
+      auditSchemaVersion: 8,
      requestSmugglingClass: 'none',
      type: 'delegate',
      kind,
@@ -128,6 +128,30 @@ export const BARE_OS_WAVE10_PROC_FILE_TO_ID = Object.freeze({
  bare_os_pear_workshop_flags: 'pear_workshop_flags'
 })

+/** Wave 11 `/proc` pseudo files → {@link ./bare-os-wave11-proc.js} ids. */
+export const BARE_OS_WAVE11_PROC_FILE_TO_ID = Object.freeze({
+  bare_os_autopass_rotation_sketch: 'autopass_rotation_sketch',
+  bare_os_bare_addon_policy: 'bare_addon_policy',
+  bare_os_bare_pack_cache: 'bare_pack_cache',
+  bare_os_bare_signals_profile: 'bare_signals_profile',
+  bare_os_bare_timers_histogram: 'bare_timers_histogram',
+  bare_os_bundle_preload_hint: 'bundle_preload_hint',
+  bare_os_drive_version_graph: 'drive_version_graph',
+  bare_os_git_lfs_budget: 'git_lfs_budget',
+  bare_os_hrpc_allowlist_sketch: 'hrpc_allowlist_sketch',
+  bare_os_hypercore_replicate_budget: 'hypercore_replicate_budget',
+  bare_os_indexer_catchup: 'indexer_catchup',
+  bare_os_multisig_quorum_pointer: 'multisig_quorum_pointer',
+  bare_os_net_qos_class: 'net_qos_class',
+  bare_os_pear_runtime_matrix: 'pear_runtime_matrix',
+  bare_os_protomux_backpressure: 'protomux_backpressure',
+  bare_os_relay_geo_hint: 'relay_geo_hint',
+  bare_os_sidecar_resource_cap: 'sidecar_resource_cap',
+  bare_os_storage_tier_hint: 'storage_tier_hint',
+  bare_os_wave11_operator_slo_v2: 'wave11_operator_slo_v2',
+  bare_os_wave11_peer_qos_sketch: 'wave11_peer_qos_sketch'
+})
+
 /**
 * Unified path view: system Hyperdrive for OS paths, personal Hyperdrive under $HOME,
 * optional HDMS mounts under /mnt/<label>/…, virtual /var with writable /var/log/…
@@ -185,6 +209,7 @@ export const BARE_OS_WAVE10_PROC_FILE_TO_ID = Object.freeze({
 *   procBareOsWave8JsonText?: (wave8Id: string) => string,
 *   procBareOsWave9JsonText?: (wave9Id: string) => string,
 *   procBareOsWave10JsonText?: (wave10Id: string) => string,
+ *   procBareOsWave11JsonText?: (wave11Id: string) => string,
 *   getUnitJournalNdjson?: (unit: string) => string,
 *   getVirtualReaders?: () => Map<string, unknown>,
 *   unionReadPrefixes?: readonly string[],
@@ -201,6 +226,33 @@ export function createVfs(
  mntRef = null,
  vfsOptions = {}
 ) {
+  /** When `BARE_OS_WAVE11_PROC` is `0` / `false` / `off`, hide Wave 11 `/proc` JSON nodes (flat + `/proc/bare_os/*` + index entries). */
+  const wave11ProcOff =
+    env &&
+    (env.BARE_OS_WAVE11_PROC === '0' ||
+      env.BARE_OS_WAVE11_PROC === 'false' ||
+      env.BARE_OS_WAVE11_PROC === 'off')
+  const wave11BareOsRelNames = new Set(
+    Object.keys(BARE_OS_WAVE11_PROC_FILE_TO_ID).map((k) => {
+      const base = k.startsWith('bare_os_') ? k.slice('bare_os_'.length) : k
+      return base.endsWith('.json') ? base : base + '.json'
+    })
+  )
+  const wave11FlatProcNames = new Set(
+    Object.keys(BARE_OS_WAVE11_PROC_FILE_TO_ID).map((k) =>
+      k.endsWith('.json') ? k : k + '.json'
+    )
+  )
+  /** @param {string[]} names */
+  function stripWave11Flat(names) {
+    if (!wave11ProcOff) return names
+    return names.filter((n) => !wave11FlatProcNames.has(n))
+  }
+  /** @param {string[]} names */
+  function stripWave11BareOs(names) {
+    if (!wave11ProcOff) return names
+    return names.filter((n) => !wave11BareOsRelNames.has(n))
+  }
  const procSnapshot = vfsOptions.procSnapshot || null
  const bootStartedMs =
    typeof vfsOptions.bootStartedMs === 'number'
@@ -379,6 +431,10 @@ export function createVfs(
    typeof vfsOptions.procBareOsWave10JsonText === 'function'
      ? vfsOptions.procBareOsWave10JsonText
      : null
+  const procBareOsWave11JsonText =
+    typeof vfsOptions.procBareOsWave11JsonText === 'function'
+      ? vfsOptions.procBareOsWave11JsonText
+      : null
  const getUnitJournalNdjson =
    typeof vfsOptions.getUnitJournalNdjson === 'function'
      ? vfsOptions.getUnitJournalNdjson
@@ -893,9 +949,21 @@ export function createVfs(
          return utf8Encode(t)
        }
      }
+      {
+        const wid11 = BARE_OS_WAVE11_PROC_FILE_TO_ID[f]
+        if (wid11 && !wave11ProcOff) {
+          const t = procBareOsWave11JsonText
+            ? procBareOsWave11JsonText(wid11)
+            : `${JSON.stringify({
+                schema: 1,
+                note: 'wave11 proc provider missing'
+              })}\n`
+          return utf8Encode(t)
+        }
+      }
      if (f === 'bare_os_proc_index') {
        const idx = {
-          schema: 6,
+          schema: 7,
          description:
            'Stable aliases under /proc/bare_os/ (same payloads as flat /proc/bare_os_* files).',
          entries: [
@@ -1321,9 +1389,98 @@ export function createVfs(
            {
              name: 'pear_workshop_flags.json',
              path: '/proc/bare_os/pear_workshop_flags.json'
+            },
+            {
+              name: 'hypercore_replicate_budget.json',
+              path: '/proc/bare_os/hypercore_replicate_budget.json'
+            },
+            {
+              name: 'drive_version_graph.json',
+              path: '/proc/bare_os/drive_version_graph.json'
+            },
+            {
+              name: 'protomux_backpressure.json',
+              path: '/proc/bare_os/protomux_backpressure.json'
+            },
+            {
+              name: 'pear_runtime_matrix.json',
+              path: '/proc/bare_os/pear_runtime_matrix.json'
+            },
+            {
+              name: 'bundle_preload_hint.json',
+              path: '/proc/bare_os/bundle_preload_hint.json'
+            },
+            {
+              name: 'autopass_rotation_sketch.json',
+              path: '/proc/bare_os/autopass_rotation_sketch.json'
+            },
+            {
+              name: 'hrpc_allowlist_sketch.json',
+              path: '/proc/bare_os/hrpc_allowlist_sketch.json'
+            },
+            {
+              name: 'sidecar_resource_cap.json',
+              path: '/proc/bare_os/sidecar_resource_cap.json'
+            },
+            {
+              name: 'git_lfs_budget.json',
+              path: '/proc/bare_os/git_lfs_budget.json'
+            },
+            {
+              name: 'net_qos_class.json',
+              path: '/proc/bare_os/net_qos_class.json'
+            },
+            {
+              name: 'storage_tier_hint.json',
+              path: '/proc/bare_os/storage_tier_hint.json'
+            },
+            {
+              name: 'indexer_catchup.json',
+              path: '/proc/bare_os/indexer_catchup.json'
+            },
+            {
+              name: 'multisig_quorum_pointer.json',
+              path: '/proc/bare_os/multisig_quorum_pointer.json'
+            },
+            {
+              name: 'relay_geo_hint.json',
+              path: '/proc/bare_os/relay_geo_hint.json'
+            },
+            {
+              name: 'bare_pack_cache.json',
+              path: '/proc/bare_os/bare_pack_cache.json'
+            },
+            {
+              name: 'bare_addon_policy.json',
+              path: '/proc/bare_os/bare_addon_policy.json'
+            },
+            {
+              name: 'bare_signals_profile.json',
+              path: '/proc/bare_os/bare_signals_profile.json'
+            },
+            {
+              name: 'bare_timers_histogram.json',
+              path: '/proc/bare_os/bare_timers_histogram.json'
+            },
+            {
+              name: 'wave11_peer_qos_sketch.json',
+              path: '/proc/bare_os/wave11_peer_qos_sketch.json'
+            },
+            {
+              name: 'wave11_operator_slo_v2.json',
+              path: '/proc/bare_os/wave11_operator_slo_v2.json'
            }
          ]
        }
+        if (wave11ProcOff) {
+          idx.entries = idx.entries.filter(
+            (e) =>
+              !(
+                typeof e.name === 'string' &&
+                wave11BareOsRelNames.has(e.name)
+              )
+          )
+        }
        return utf8Encode(JSON.stringify(idx, null, 2) + '\n')
      }
      if (f === 'self_fd') {
@@ -1709,9 +1866,60 @@ export function createVfs(
          'pear_user_dirs_map.json': 'bare_os_pear_user_dirs_map',
          pear_workshop_flags: 'bare_os_pear_workshop_flags',
          'pear_workshop_flags.json': 'bare_os_pear_workshop_flags',
+          hypercore_replicate_budget: 'bare_os_hypercore_replicate_budget',
+          'hypercore_replicate_budget.json':
+            'bare_os_hypercore_replicate_budget',
+          drive_version_graph: 'bare_os_drive_version_graph',
+          'drive_version_graph.json': 'bare_os_drive_version_graph',
+          protomux_backpressure: 'bare_os_protomux_backpressure',
+          'protomux_backpressure.json': 'bare_os_protomux_backpressure',
+          pear_runtime_matrix: 'bare_os_pear_runtime_matrix',
+          'pear_runtime_matrix.json': 'bare_os_pear_runtime_matrix',
+          bundle_preload_hint: 'bare_os_bundle_preload_hint',
+          'bundle_preload_hint.json': 'bare_os_bundle_preload_hint',
+          autopass_rotation_sketch: 'bare_os_autopass_rotation_sketch',
+          'autopass_rotation_sketch.json':
+            'bare_os_autopass_rotation_sketch',
+          hrpc_allowlist_sketch: 'bare_os_hrpc_allowlist_sketch',
+          'hrpc_allowlist_sketch.json': 'bare_os_hrpc_allowlist_sketch',
+          sidecar_resource_cap: 'bare_os_sidecar_resource_cap',
+          'sidecar_resource_cap.json': 'bare_os_sidecar_resource_cap',
+          git_lfs_budget: 'bare_os_git_lfs_budget',
+          'git_lfs_budget.json': 'bare_os_git_lfs_budget',
+          net_qos_class: 'bare_os_net_qos_class',
+          'net_qos_class.json': 'bare_os_net_qos_class',
+          storage_tier_hint: 'bare_os_storage_tier_hint',
+          'storage_tier_hint.json': 'bare_os_storage_tier_hint',
+          indexer_catchup: 'bare_os_indexer_catchup',
+          'indexer_catchup.json': 'bare_os_indexer_catchup',
+          multisig_quorum_pointer: 'bare_os_multisig_quorum_pointer',
+          'multisig_quorum_pointer.json':
+            'bare_os_multisig_quorum_pointer',
+          relay_geo_hint: 'bare_os_relay_geo_hint',
+          'relay_geo_hint.json': 'bare_os_relay_geo_hint',
+          bare_pack_cache: 'bare_os_bare_pack_cache',
+          'bare_pack_cache.json': 'bare_os_bare_pack_cache',
+          bare_addon_policy: 'bare_os_bare_addon_policy',
+          'bare_addon_policy.json': 'bare_os_bare_addon_policy',
+          bare_signals_profile: 'bare_os_bare_signals_profile',
+          'bare_signals_profile.json': 'bare_os_bare_signals_profile',
+          bare_timers_histogram: 'bare_os_bare_timers_histogram',
+          'bare_timers_histogram.json': 'bare_os_bare_timers_histogram',
+          wave11_peer_qos_sketch: 'bare_os_wave11_peer_qos_sketch',
+          'wave11_peer_qos_sketch.json': 'bare_os_wave11_peer_qos_sketch',
+          wave11_operator_slo_v2: 'bare_os_wave11_operator_slo_v2',
+          'wave11_operator_slo_v2.json': 'bare_os_wave11_operator_slo_v2',
          'initd_graph.json': 'bare_os_initd_graph'
        }[rest]
        if (alias) {
+          if (
+            wave11ProcOff &&
+            /** @type {Record<string, string>} */ (BARE_OS_WAVE11_PROC_FILE_TO_ID)[
+              alias
+            ]
+          ) {
+            return { virtualPseudo: true, kind: 'proc', node: 'enoent' }
+          }
          return {
            virtualPseudo: true,
            kind: 'proc',
@@ -2065,6 +2273,17 @@ export function createVfs(
            file: stripped
          }
        }
+        if (
+          !wave11ProcOff &&
+          BARE_OS_WAVE11_PROC_FILE_TO_ID[stripped]
+        ) {
+          return {
+            virtualPseudo: true,
+            kind: 'proc',
+            node: 'file',
+            file: stripped
+          }
+        }
      }
      return { virtualPseudo: true, kind: 'proc', node: 'enoent' }
    }
@@ -2804,12 +3023,14 @@ export function createVfs(
        throw new Error('Not a directory: ' + abs)
      }
      if (pr.kind === 'proc' && pr.node === 'root') {
-        return [
+        return stripWave11Flat([
          'bare_os',
          'bare_os_activity_queue_depth.json',
          'bare_os_async_hooks_lag.json',
          'bare_os_autobase_writer_hint.json',
          'bare_os_autopass_session_sketch.json',
+          'bare_os_autopass_rotation_sketch.json',
+          'bare_os_bare_addon_policy.json',
          'bare_os_bare_boot_phase_map.json',
          'bare_os_bare_crypto_policy.json',
          'bare_os_bare_daemon_hooks.json',
@@ -2820,13 +3041,16 @@ export function createVfs(
          'bare_os_bare_logger_policy.json',
          'bare_os_bare_module_resolution.json',
          'bare_os_bare_net_interfaces.json',
+          'bare_os_bare_pack_cache.json',
          'bare_os_bare_performance_counters.json',
          'bare_os_bare_rpc_registry_sketch.json',
          'bare_os_bare_signals_mask.json',
+          'bare_os_bare_signals_profile.json',
          'bare_os_bare_storage_quota.json',
          'bare_os_bare_stream_backpressure.json',
          'bare_os_bare_thread_pool.json',
          'bare_os_bare_timers_budget.json',
+          'bare_os_bare_timers_histogram.json',
          'bare_os_bare_tls_session_hint.json',
          'bare_os_bare_vm_sandbox_sketch.json',
          'bare_os_bare_worker_pool.json',
@@ -2836,6 +3060,7 @@ export function createVfs(
          'bare_os_bootstrap',
          'bare_os_brittle_snapshot_ci.json',
          'bare_os_broadcast_encryption_hint.json',
+          'bare_os_bundle_preload_hint.json',
          'bare_os_build_attestation_pointer.json',
          'bare_os_capabilities',
          'bare_os_capabilities.json',
@@ -2847,6 +3072,7 @@ export function createVfs(
          'bare_os_dht_status.json',
          'bare_os_dns_map_active.json',
          'bare_os_drive_resolve_cache.json',
+          'bare_os_drive_version_graph.json',
          'bare_os_extensions.json',
          'bare_os_features',
          'bare_os_form_data_delegate_limits_v2.json',
@@ -2854,18 +3080,23 @@ export function createVfs(
          'bare_os_gip_transport_sketch.json',
          'bare_os_git_delegate_stats.json',
          'bare_os_git_lfs_pointer_stats.json',
+          'bare_os_git_lfs_budget.json',
          'bare_os_hdms_health.json',
          'bare_os_hdms_hints.json',
          'bare_os_host_os.json',
          'bare_os_hrpc_bridge_health.json',
+          'bare_os_hrpc_allowlist_sketch.json',
          'bare_os_http_dht_proxy_route.json',
          'bare_os_hyper_multisig_trust_pointer.json',
          'bare_os_hypercore_lengths.json',
          'bare_os_hypercore_repair_hint.json',
+          'bare_os_hypercore_replicate_budget.json',
          'bare_os_hypercore_signing_status.json',
          'bare_os_hyperdb_readonly_index.json',
          'bare_os_hyperdrive_sparse_index.json',
          'bare_os_hypermininet_topology.json',
+          'bare_os_indexer_catchup.json',
+          'bare_os_multisig_quorum_pointer.json',
          'bare_os_initd_dag.json',
          'bare_os_initd_graph.json',
          'bare_os_ipc_backpressure.json',
@@ -2874,6 +3105,7 @@ export function createVfs(
          'bare_os_manifest_hints',
          'bare_os_metrics_live.json',
          'bare_os_net_summary.json',
+          'bare_os_net_qos_class.json',
          'bare_os_oidc_publishing_pointer.json',
          'bare_os_pear_api_allowlist_sketch.json',
          'bare_os_pear_appling_manifest.json',
@@ -2882,6 +3114,7 @@ export function createVfs(
          'bare_os_pear_drop_events.json',
          'bare_os_pear_ipc_health.json',
          'bare_os_pear_radio_state.json',
+          'bare_os_pear_runtime_matrix.json',
          'bare_os_pear_rti_pointer.json',
          'bare_os_pear_sidecar_bundle_index.json',
          'bare_os_pear_stage_pointer.json',
@@ -2891,6 +3124,7 @@ export function createVfs(
          'bare_os_pear_wakeups_schedule.json',
          'bare_os_pear_workshop_flags.json',
          'bare_os_peer_health',
+          'bare_os_protomux_backpressure.json',
          'bare_os_protomux_channel_alias_v2.json',
          'bare_os_protomux_channels.json',
          'bare_os_protomux_rpc_pool_health.json',
@@ -2899,6 +3133,7 @@ export function createVfs(
          'bare_os_react_native_bare_kit.json',
          'bare_os_replication',
          'bare_os_replication_backpressure.json',
+          'bare_os_relay_geo_hint.json',
          'bare_os_resources',
          'bare_os_rlimits.json',
          'bare_os_rocksdb_pointer.json',
@@ -2906,9 +3141,11 @@ export function createVfs(
          'bare_os_sandbox_profile.json',
          'bare_os_sandbox_worker_queue.json',
          'bare_os_security_context.json',
+          'bare_os_sidecar_resource_cap.json',
          'bare_os_seed_handshake',
          'bare_os_session_stats',
          'bare_os_slo_hints.json',
+          'bare_os_storage_tier_hint.json',
          'bare_os_snapshot_hints',
          'bare_os_snapshot_hints.json',
          'bare_os_staging_slot',
@@ -2922,6 +3159,8 @@ export function createVfs(
          'bare_os_version',
          'bare_os_virtual_registry',
          'bare_os_worker_budget.json',
+          'bare_os_wave11_operator_slo_v2.json',
+          'bare_os_wave11_peer_qos_sketch.json',
          'cpuinfo',
          'diskstats',
          'loadavg',
@@ -2931,18 +3170,20 @@ export function createVfs(
          'self',
          'uptime',
          'version'
-        ]
+        ])
      }
      if (
        pr.kind === 'proc' &&
        pr.node === 'dir' &&
        pr.dir === 'bare_os_proc'
      ) {
-        return [
+        return stripWave11BareOs([
          'activity_queue_depth.json',
          'async_hooks_lag.json',
          'autobase_writer_hint.json',
          'autopass_session_sketch.json',
+          'autopass_rotation_sketch.json',
+          'bare_addon_policy.json',
          'bare_boot_phase_map.json',
          'bare_crypto_policy.json',
          'bare_daemon_hooks.json',
@@ -2953,13 +3194,16 @@ export function createVfs(
          'bare_logger_policy.json',
          'bare_module_resolution.json',
          'bare_net_interfaces.json',
+          'bare_pack_cache.json',
          'bare_performance_counters.json',
          'bare_rpc_registry_sketch.json',
          'bare_signals_mask.json',
+          'bare_signals_profile.json',
          'bare_storage_quota.json',
          'bare_stream_backpressure.json',
          'bare_thread_pool.json',
          'bare_timers_budget.json',
+          'bare_timers_histogram.json',
          'bare_tls_session_hint.json',
          'bare_vm_sandbox_sketch.json',
          'bare_worker_pool.json',
@@ -2969,6 +3213,7 @@ export function createVfs(
          'bootstrap',
          'brittle_snapshot_ci.json',
          'broadcast_encryption_hint.json',
+          'bundle_preload_hint.json',
          'build_attestation_pointer.json',
          'capabilities',
          'capabilities.json',
@@ -2980,6 +3225,7 @@ export function createVfs(
          'dht_status.json',
          'dns_map_active.json',
          'drive_resolve_cache.json',
+          'drive_version_graph.json',
          'extensions.json',
          'features',
          'form_data_delegate_limits.json',
@@ -2987,14 +3233,17 @@ export function createVfs(
          'gip_transport_sketch.json',
          'git_delegate_stats.json',
          'git_lfs_pointer_stats.json',
+          'git_lfs_budget.json',
          'hdms_health.json',
          'hdms_hints.json',
          'host_os.json',
          'hrpc_bridge_health.json',
+          'hrpc_allowlist_sketch.json',
          'http_dht_proxy_route.json',
          'hyper_multisig_trust_pointer.json',
          'hypercore_lengths.json',
          'hypercore_repair_hint.json',
+          'hypercore_replicate_budget.json',
          'hypercore_signing_status.json',
          'hyperdb_readonly_index.json',
          'hyperdrive_sparse_index.json',
@@ -3002,11 +3251,14 @@ export function createVfs(
          'index.json',
          'initd_dag.json',
          'initd_graph.json',
+          'indexer_catchup.json',
          'ipc_backpressure.json',
          'libmqjs_queue_depth.json',
          'locale.json',
          'manifest_hints',
          'metrics_live.json',
+          'multisig_quorum_pointer.json',
+          'net_qos_class.json',
          'net_summary.json',
          'oidc_publishing_pointer.json',
          'pear_api_allowlist_sketch.json',
@@ -3017,6 +3269,7 @@ export function createVfs(
          'pear_ipc.json',
          'pear_ipc_health.json',
          'pear_radio_state.json',
+          'pear_runtime_matrix.json',
          'pear_rti_pointer.json',
          'pear_sidecar_bundle_index.json',
          'pear_stage_pointer.json',
@@ -3026,6 +3279,7 @@ export function createVfs(
          'pear_wakeups_schedule.json',
          'pear_workshop_flags.json',
          'peer_health',
+          'protomux_backpressure.json',
          'protomux_channel_alias_v2.json',
          'protomux_channels.json',
          'protomux_rpc_pool_health.json',
@@ -3034,6 +3288,7 @@ export function createVfs(
          'react_native_bare_kit.json',
          'replication',
          'replication_backpressure.json',
+          'relay_geo_hint.json',
          'resources',
          'rlimits.json',
          'rocksdb_pointer.json',
@@ -3041,9 +3296,11 @@ export function createVfs(
          'sandbox_profile.json',
          'sandbox_worker_queue.json',
          'security_context.json',
+          'sidecar_resource_cap.json',
          'seed_handshake',
          'session_stats',
          'slo_hints.json',
+          'storage_tier_hint.json',
          'snapshot_hints',
          'snapshot_hints.json',
          'staging_slot',
@@ -3056,9 +3313,11 @@ export function createVfs(
          'updater_download_state.json',
          'version',
          'virtual_registry',
-          'worker_budget.json'
+          'worker_budget.json',
+          'wave11_operator_slo_v2.json',
+          'wave11_peer_qos_sketch.json'

-        ]
+        ])
      }
      if (pr.kind === 'proc' && pr.node === 'dir' && pr.dir === 'net') {
        return ['dev', 'tcp', 'udp']
@@ -11,7 +11,10 @@ import { runKernelFromSource, runBinCommand } from './lib/kernel-runner.js'
 import { createGitFsFromVfs } from './lib/git-fs-adapter.js'
 import { runGitCli } from './lib/git-cli.js'
 import { createStreamLineReader } from './lib/cli-readline.js'
-import { createVfs } from './lib/vfs.js'
+import {
+  createVfs,
+  BARE_OS_WAVE11_PROC_FILE_TO_ID
+} from './lib/vfs.js'
 import { createBareOsIpc } from './lib/bare-os-ipc.js'
 import { bareOsHttpUrlAllowed } from './lib/bare-os-http-policy.js'
 import { raceWithAbortAndTimeout } from './lib/bare-os-abort.js'
@@ -859,7 +862,9 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_activity_queue_depth.json',
    'bare_os_async_hooks_lag.json',
    'bare_os_autobase_writer_hint.json',
+    'bare_os_autopass_rotation_sketch.json',
    'bare_os_autopass_session_sketch.json',
+    'bare_os_bare_addon_policy.json',
    'bare_os_bare_boot_phase_map.json',
    'bare_os_bare_crypto_policy.json',
    'bare_os_bare_daemon_hooks.json',
@@ -870,13 +875,16 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_bare_logger_policy.json',
    'bare_os_bare_module_resolution.json',
    'bare_os_bare_net_interfaces.json',
+    'bare_os_bare_pack_cache.json',
    'bare_os_bare_performance_counters.json',
    'bare_os_bare_rpc_registry_sketch.json',
    'bare_os_bare_signals_mask.json',
+    'bare_os_bare_signals_profile.json',
    'bare_os_bare_storage_quota.json',
    'bare_os_bare_stream_backpressure.json',
    'bare_os_bare_thread_pool.json',
    'bare_os_bare_timers_budget.json',
+    'bare_os_bare_timers_histogram.json',
    'bare_os_bare_tls_session_hint.json',
    'bare_os_bare_vm_sandbox_sketch.json',
    'bare_os_bare_worker_pool.json',
@@ -887,6 +895,7 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_brittle_snapshot_ci.json',
    'bare_os_broadcast_encryption_hint.json',
    'bare_os_build_attestation_pointer.json',
+    'bare_os_bundle_preload_hint.json',
    'bare_os_capabilities',
    'bare_os_capabilities.json',
    'bare_os_cellery_sidecar_hint.json',
@@ -897,25 +906,30 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_dht_status.json',
    'bare_os_dns_map_active.json',
    'bare_os_drive_resolve_cache.json',
+    'bare_os_drive_version_graph.json',
    'bare_os_extensions.json',
    'bare_os_features',
    'bare_os_form_data_delegate_limits.json',
    'bare_os_form_data_delegate_limits_v2.json',
    'bare_os_gip_transport_sketch.json',
    'bare_os_git_delegate_stats.json',
+    'bare_os_git_lfs_budget.json',
    'bare_os_git_lfs_pointer_stats.json',
    'bare_os_hdms_health.json',
    'bare_os_hdms_hints.json',
    'bare_os_host_os.json',
+    'bare_os_hrpc_allowlist_sketch.json',
    'bare_os_hrpc_bridge_health.json',
    'bare_os_http_dht_proxy_route.json',
    'bare_os_hyper_multisig_trust_pointer.json',
    'bare_os_hypercore_lengths.json',
    'bare_os_hypercore_repair_hint.json',
+    'bare_os_hypercore_replicate_budget.json',
    'bare_os_hypercore_signing_status.json',
    'bare_os_hyperdb_readonly_index.json',
    'bare_os_hyperdrive_sparse_index.json',
    'bare_os_hypermininet_topology.json',
+    'bare_os_indexer_catchup.json',
    'bare_os_initd_dag.json',
    'bare_os_initd_graph.json',
    'bare_os_ipc_backpressure.json',
@@ -923,6 +937,8 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_locale.json',
    'bare_os_manifest_hints',
    'bare_os_metrics_live.json',
+    'bare_os_multisig_quorum_pointer.json',
+    'bare_os_net_qos_class.json',
    'bare_os_net_summary.json',
    'bare_os_oidc_publishing_pointer.json',
    'bare_os_pear_api_allowlist_sketch.json',
@@ -933,6 +949,7 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_pear_ipc_health.json',
    'bare_os_pear_radio_state.json',
    'bare_os_pear_rti_pointer.json',
+    'bare_os_pear_runtime_matrix.json',
    'bare_os_pear_sidecar_bundle_index.json',
    'bare_os_pear_stage_pointer.json',
    'bare_os_pear_trust.json',
@@ -941,12 +958,14 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_pear_wakeups_schedule.json',
    'bare_os_pear_workshop_flags.json',
    'bare_os_peer_health',
+    'bare_os_protomux_backpressure.json',
    'bare_os_protomux_channel_alias_v2.json',
    'bare_os_protomux_channels.json',
    'bare_os_protomux_rpc_pool_health.json',
    'bare_os_provenance',
    'bare_os_quotas',
    'bare_os_react_native_bare_kit.json',
+    'bare_os_relay_geo_hint.json',
    'bare_os_replication',
    'bare_os_replication_backpressure.json',
    'bare_os_resources',
@@ -958,10 +977,12 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_security_context.json',
    'bare_os_seed_handshake',
    'bare_os_session_stats',
+    'bare_os_sidecar_resource_cap.json',
    'bare_os_slo_hints.json',
    'bare_os_snapshot_hints',
    'bare_os_snapshot_hints.json',
    'bare_os_staging_slot',
+    'bare_os_storage_tier_hint.json',
    'bare_os_structured_clone_budget_v2.json',
    'bare_os_structured_clone_profile.json',
    'bare_os_swarm',
@@ -971,6 +992,8 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
    'bare_os_updater_download_state.json',
    'bare_os_version',
    'bare_os_virtual_registry',
+    'bare_os_wave11_operator_slo_v2.json',
+    'bare_os_wave11_peer_qos_sketch.json',
    'bare_os_worker_budget.json',
    'cpuinfo',
    'diskstats',
@@ -1072,6 +1095,53 @@ test('vfs /proc /sys read-only pseudo files; write rejected', async (t) => {
  rmSync(dir, { recursive: true, force: true })
 })

+test('vfs BARE_OS_WAVE11_PROC=0 hides wave11 proc nodes', async (t) => {
+  const dir = testCorestoreDir('vfsprocw11')
+  const store = new Corestore(dir)
+  const sys = new Hyperdrive(store)
+  const personal = new Hyperdrive(store.namespace('pvprocw11'))
+  await sys.ready()
+  await personal.ready()
+  const env = {
+    HOME: '/home/guest',
+    PWD: '/home/guest',
+    PATH: '/bin',
+    USER: 'guest',
+    BARE_OS_WAVE11_PROC: '0'
+  }
+  const mntMap = new Map()
+  const vfs = createVfs(sys, personal, env, { getMounts: () => mntMap }, {
+    procBareOsSwarmText: () => '{}\n'
+  })
+  const flatW11 = Object.keys(BARE_OS_WAVE11_PROC_FILE_TO_ID).map((k) =>
+    k.endsWith('.json') ? k : `${k}.json`
+  )
+  const bareOsW11 = Object.keys(BARE_OS_WAVE11_PROC_FILE_TO_ID).map((k) => {
+    const base = k.startsWith('bare_os_') ? k.slice('bare_os_'.length) : k
+    return base.endsWith('.json') ? base : `${base}.json`
+  })
+  const procRoot = await vfs.readdir('/proc').then((a) => [...a])
+  for (const n of flatW11) {
+    t.ok(!procRoot.includes(n), `flat ${n} should be hidden`)
+  }
+  const bo = await vfs.readdir('/proc/bare_os').then((a) => [...a])
+  for (const n of bareOsW11) {
+    t.ok(!bo.includes(n), `bare_os/${n} should be hidden`)
+  }
+  t.is(
+    await vfs.readFile('/proc/bare_os_hypercore_replicate_budget.json'),
+    null
+  )
+  const idxRaw = b4a.toString(await vfs.readFile('/proc/bare_os/index.json'))
+  const idx = JSON.parse(idxRaw)
+  t.ok(Array.isArray(idx.entries))
+  const names = new Set(idx.entries.map((e) => e.name))
+  t.ok(!names.has('hypercore_replicate_budget.json'))
+  t.ok(!names.has('wave11_peer_qos_sketch.json'))
+  await store.close()
+  rmSync(dir, { recursive: true, force: true })
+})
+
 test('vfs /proc/self/environ omits secret-like env keys', async (t) => {
  const dir = testCorestoreDir('vfsprocenv')
  const store = new Corestore(dir)
@@ -0,0 +1,8 @@
+# Changelog — `bare-os-protocol`
+
+## 0.7.0
+
+- Eleventh capability word **`bits11`** with **`BARE_OS_KERNEL_FEATURES_STOCK_V11`** and **`BARE_OS_FEATURE11_*`**.
+- **`BARE_OS_KERNEL_FEATURE_BITS_DOC`** **13**.
+- Twenty new **`bare_os.*`** seed RPC short names (wave 11), wired in **`lib/channel.js`**.
+- **`bits11`** on **`bare_os.capabilities`** and related kernel_info adjuncts.
@@ -10,9 +10,9 @@ Shared **wire format and constants** for the Bare operating system monorepo: Hyp
 | `topicKey()`                    | 32-byte topic for `swarm.join()`                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `BLOCK_SIZE`, `MBR_MAGIC`       | 512-byte MBR, magic `BIOS` at offset 0                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `buildMbr` / `parseMbr`         | Pack/unpack primary + optional failover Hyperdrive keys                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `setupSeedChannel`              | Wire Protomux messages 0–6 for RAM block reads, gossip bitfield, manifest path **search**, **RPC** (incl. `bare_os.capabilities` with **`bits`** … **`bits10`** when non-zero, typed errors for unknown RPC methods, `bare_os.replication_status`, `bare_os.replication_queue`, wave 6–10 RPC short names in **`seed-rpc-methods.js`**, `bare_os.gossip`), and `drive.replicate` |
+| `setupSeedChannel`              | Wire Protomux messages 0–6 for RAM block reads, gossip bitfield, manifest path **search**, **RPC** (incl. `bare_os.capabilities` with **`bits`** … **`bits11`** when non-zero, typed errors for unknown RPC methods, `bare_os.replication_status`, `bare_os.replication_queue`, wave 6–11 RPC short names in **`seed-rpc-methods.js`**, `bare_os.gossip`), and `drive.replicate` |

-Subpath exports: `bare-os-protocol/constants.js`, `bare-os-protocol/messages` (compact-encoding schemas), `bare-os-protocol/kernel-feature-bits.js` (documented booter capability words **`STOCK_V1`** … **`STOCK_V10`**; **`BARE_OS_KERNEL_FEATURE_BITS_DOC=12`**; surfaced in **`/proc/bare_os_features`** and **`/proc/bare_os/`**), `bare-os-protocol/lib/seed-rpc-methods.js` (authoritative **`bare_os.*`** RPC name list for **`kernel_info`**), `bare-os-protocol/protocol-meta.js` (**`BARE_OS_PROTOCOL_PACKAGE_VERSION`** for the seed handshake).
+Subpath exports: `bare-os-protocol/constants.js`, `bare-os-protocol/messages` (compact-encoding schemas), `bare-os-protocol/kernel-feature-bits.js` (documented booter capability words **`STOCK_V1`** … **`STOCK_V11`**; **`BARE_OS_KERNEL_FEATURE_BITS_DOC=13`**; surfaced in **`/proc/bare_os_features`** and **`/proc/bare_os/`**), `bare-os-protocol/lib/seed-rpc-methods.js` (authoritative **`bare_os.*`** RPC name list for **`kernel_info`**), `bare-os-protocol/protocol-meta.js` (**`BARE_OS_PROTOCOL_PACKAGE_VERSION`** for the seed handshake).

 ## Consumers

@@ -188,5 +188,20 @@ export {
  BARE_OS_FEATURE10_WORKER_NET_WAVE10,
  BARE_OS_FEATURE10_TELEMETRY_AUDIT_WAVE10,
  BARE_OS_FEATURE10_DOC_CI_WAVE10,
-  BARE_OS_FEATURE10_COMPACT_READY_RPC_V4
+  BARE_OS_FEATURE10_COMPACT_READY_RPC_V4,
+  BARE_OS_KERNEL_FEATURES_STOCK_V11,
+  BARE_OS_FEATURE11_CAP_WORD,
+  BARE_OS_FEATURE11_SEED_RPC_WAVE11,
+  BARE_OS_FEATURE11_REPLICATION_JSON_WAVE11,
+  BARE_OS_FEATURE11_PROC_METRICS_WAVE11,
+  BARE_OS_FEATURE11_BOOT_POLICY_V11,
+  BARE_OS_FEATURE11_KERNEL_EXT_REGISTRY_V8,
+  BARE_OS_FEATURE11_PEAR_BARE_BRIDGE_WAVE11,
+  BARE_OS_FEATURE11_VFS_POSIX_WAVE11,
+  BARE_OS_FEATURE11_INITD_SUBPROC_WAVE11,
+  BARE_OS_FEATURE11_WORKER_NET_WAVE11,
+  BARE_OS_FEATURE11_TELEMETRY_AUDIT_WAVE11,
+  BARE_OS_FEATURE11_DOC_CI_WAVE11,
+  BARE_OS_FEATURE11_HTTP_DHT_PROXY_ROUTES_V3,
+  BARE_OS_FEATURE11_COMPACT_READY_RPC_V5
 } from './lib/kernel-feature-bits.js'
@@ -12,7 +12,8 @@ import {
  BARE_OS_KERNEL_FEATURES_STOCK_V7,
  BARE_OS_KERNEL_FEATURES_STOCK_V8,
  BARE_OS_KERNEL_FEATURES_STOCK_V9,
-  BARE_OS_KERNEL_FEATURES_STOCK_V10
+  BARE_OS_KERNEL_FEATURES_STOCK_V10,
+  BARE_OS_KERNEL_FEATURES_STOCK_V11
 } from './kernel-feature-bits.js'
 import {
  BARE_OS_SEED_RPC_METHODS,
@@ -152,7 +153,27 @@ import {
 *   pearTerminalCapsJson?: string,
 *   readyGuardV4Json?: string,
 *   mirrorDriveCompactionV5Json?: string,
- *   blindRelayCircuitV3Json?: string
+ *   blindRelayCircuitV3Json?: string,
+ *   hypercoreReplicateBudgetV2Json?: string,
+ *   driveVersionGraphJson?: string,
+ *   protomuxBackpressureV3Json?: string,
+ *   pearRuntimeMatrixJson?: string,
+ *   bundlePreloadHintJson?: string,
+ *   autopassRotationHintJson?: string,
+ *   hrpcMethodAllowlistJson?: string,
+ *   sidecarResourceCapJson?: string,
+ *   gitLfsBudgetJson?: string,
+ *   netQosClassJson?: string,
+ *   storageTierHintJson?: string,
+ *   indexerCatchupJson?: string,
+ *   multisigQuorumHintJson?: string,
+ *   relayGeoHintJson?: string,
+ *   compactPingV5Json?: string,
+ *   stagingSlotV8Json?: string,
+ *   peerFirewallStatsV6Json?: string,
+ *   httpDhtProxyRoutesV3Json?: string,
+ *   readyGuardV5Json?: string,
+ *   mirrorDriveCompactionV6Json?: string
 * }} [opts]
 */
 export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
@@ -409,6 +430,7 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
            bits8: BARE_OS_KERNEL_FEATURES_STOCK_V8 >>> 0,
            bits9: BARE_OS_KERNEL_FEATURES_STOCK_V9 >>> 0,
            bits10: BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0,
+            bits11: BARE_OS_KERNEL_FEATURES_STOCK_V11 >>> 0,
            protocolPackageVersion: BARE_OS_PROTOCOL_PACKAGE_VERSION,
            booterPackageVersion: booterPackageVersionHint || undefined,
            role: 'seeder',
@@ -1524,6 +1546,166 @@ export function setupSeedChannel(mux, localRAM, replicateDrive, opts = {}) {
        })
        return
      }
+      if (m.module === 'bare_os' && m.method === 'hypercore_replicate_budget_v2') {
+        const h = parseOptJson(opts.hypercoreReplicateBudgetV2Json)
+        sendWave9Rpc({
+          replicateBudgetV2: h || { note: 'hypercore replicate queue budget v2' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'drive_version_graph') {
+        const h = parseOptJson(opts.driveVersionGraphJson)
+        sendWave9Rpc({
+          driveVersionGraph: h || { note: 'multi-drive lineage sketch' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'protomux_backpressure_v3') {
+        const h = parseOptJson(opts.protomuxBackpressureV3Json)
+        sendWave9Rpc({
+          protomuxBackpressureV3: h || { note: 'protomux channel depth hints' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'pear_runtime_matrix') {
+        const h = parseOptJson(opts.pearRuntimeMatrixJson)
+        sendWave9Rpc({
+          pearRuntimeMatrix: h || { note: 'pear-runtime channel matrix' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'bundle_preload_hint') {
+        const h = parseOptJson(opts.bundlePreloadHintJson)
+        sendWave9Rpc({
+          bundlePreload: h || { note: 'cold-start bundle preload list' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'autopass_rotation_hint') {
+        const h = parseOptJson(opts.autopassRotationHintJson)
+        sendWave9Rpc({
+          autopassRotation: h || { note: 'autopass rotation schedule class' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'hrpc_method_allowlist') {
+        const h = parseOptJson(opts.hrpcMethodAllowlistJson)
+        sendWave9Rpc({
+          hrpcAllowlist: h || { note: 'hrpc method allowlist sketch' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'sidecar_resource_cap') {
+        const h = parseOptJson(opts.sidecarResourceCapJson)
+        sendWave9Rpc({
+          sidecarResourceCap: h || { note: 'sidecar CPU/mem class' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'git_lfs_budget') {
+        const h = parseOptJson(opts.gitLfsBudgetJson)
+        sendWave9Rpc({
+          gitLfsBudget: h || { note: 'git LFS bandwidth window' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'net_qos_class') {
+        const h = parseOptJson(opts.netQosClassJson)
+        sendWave9Rpc({
+          netQosClass: h || { note: 'egress QoS class hint' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'storage_tier_hint') {
+        const h = parseOptJson(opts.storageTierHintJson)
+        sendWave9Rpc({
+          storageTier: h || { note: 'hot/warm/cold storage pointer' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'indexer_catchup') {
+        const h = parseOptJson(opts.indexerCatchupJson)
+        sendWave9Rpc({
+          indexerCatchup: h || { note: 'Hyperbee/HyperDB lag budget' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'multisig_quorum_hint') {
+        const h = parseOptJson(opts.multisigQuorumHintJson)
+        sendWave9Rpc({
+          multisigQuorum: h || { note: 'multisig quorum policy pointer' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'relay_geo_hint') {
+        const h = parseOptJson(opts.relayGeoHintJson)
+        sendWave9Rpc({
+          relayGeo: h || { note: 'coarse relay region tags' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'compact_ping_v5') {
+        const perf = globalThis.performance
+        const tUs =
+          perf && typeof perf.now === 'function'
+            ? Math.floor(perf.now() * 1000)
+            : Date.now() * 1000
+        const v5 = parseOptJson(opts.compactPingV5Json)
+        chan.messages[6].send({
+          id: m.id,
+          success: true,
+          result: JSON.stringify({
+            role: 'seeder',
+            pong: true,
+            tUs,
+            protocol: PROTOCOL_NAME,
+            schema: 5,
+            variant: 'compact_ping_v5',
+            wave11: v5 || { note: 'compact ping v5' },
+            atMs: Date.now()
+          }),
+          error: ''
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'staging_slot_v8') {
+        const h = parseOptJson(opts.stagingSlotV8Json)
+        sendWave9Rpc({
+          stagingSlotV8:
+            h || { schema: 8, note: 'staging slot wave 11 triple' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'peer_firewall_stats_v6') {
+        const h = parseOptJson(opts.peerFirewallStatsV6Json)
+        sendWave9Rpc({
+          peerFirewallV6: h || { note: 'peer firewall stats v6' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'http_dht_proxy_routes_v3') {
+        const h = parseOptJson(opts.httpDhtProxyRoutesV3Json)
+        sendWave9Rpc({
+          routesV3: h || { revision: 0, note: 'http-dht-proxy routes v3' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'ready_guard_v5') {
+        const h = parseOptJson(opts.readyGuardV5Json)
+        sendWave9Rpc({
+          readyGuardV5:
+            h || { matrix: [], note: 'ready-guard v5 enum expansion' }
+        })
+        return
+      }
+      if (m.module === 'bare_os' && m.method === 'mirror_drive_compaction_v6') {
+        const h = parseOptJson(opts.mirrorDriveCompactionV6Json)
+        sendWave9Rpc({
+          compactionV6:
+            h || { phases: [], note: 'mirror-drive compaction enum v6' }
+        })
+        return
+      }
      chan.messages[6].send({
        id: m.id,
        success: false,
@@ -4,7 +4,7 @@
 */

 /** Protocol document version for this bitmask file (bump when bit semantics or governance changes). */
-export const BARE_OS_KERNEL_FEATURE_BITS_DOC = 12
+export const BARE_OS_KERNEL_FEATURE_BITS_DOC = 13

 /**
 * Second capability word (bits 0–31, always use `>>> 0` when masking).
@@ -520,6 +520,55 @@ export const BARE_OS_KERNEL_FEATURES_STOCK_V10 =
  BARE_OS_FEATURE10_DOC_CI_WAVE10 |
  BARE_OS_FEATURE10_COMPACT_READY_RPC_V4

+/**
+ * Eleventh capability word (bits 0–31, use `>>> 0`). Wave 11 mega-phase — ADR 001 §14.
+ */
+/** Word11 bit 0: `bits11` on seed `capabilities` + `/proc/bare_os_features`. */
+export const BARE_OS_FEATURE11_CAP_WORD = 1 << 0
+/** Word11 bit 1: Extended seed RPCs (hypercore_replicate_budget_v2, drive_version_graph, …). */
+export const BARE_OS_FEATURE11_SEED_RPC_WAVE11 = 1 << 1
+/** Word11 bit 2: Replication JSON / staging_slot_v8 / peer_firewall_stats_v6 adjuncts. */
+export const BARE_OS_FEATURE11_REPLICATION_JSON_WAVE11 = 1 << 2
+/** Word11 bit 3: Wave 11 `/proc/bare_os/*.json` (hypercore budget, pear matrix, bare-pack, …). */
+export const BARE_OS_FEATURE11_PROC_METRICS_WAVE11 = 1 << 3
+/** Word11 bit 4: Boot policy v11 (`requireFeatureBits11`, `requireBarePackMin`, …). */
+export const BARE_OS_FEATURE11_BOOT_POLICY_V11 = 1 << 4
+/** Word11 bit 5: Kernel extension registry schema 8 + extensionSignerPins v4 hints. */
+export const BARE_OS_FEATURE11_KERNEL_EXT_REGISTRY_V8 = 1 << 5
+/** Word11 bit 6: Pear/Bare bridge wave 11 (runtime matrix, bundle preload, …). */
+export const BARE_OS_FEATURE11_PEAR_BARE_BRIDGE_WAVE11 = 1 << 6
+/** Word11 bit 7: VFS/POSIX/shell wave 11. */
+export const BARE_OS_FEATURE11_VFS_POSIX_WAVE11 = 1 << 7
+/** Word11 bit 8: Initd / subprocess / limits wave 11. */
+export const BARE_OS_FEATURE11_INITD_SUBPROC_WAVE11 = 1 << 8
+/** Word11 bit 9: Workers / sandbox / net wave 11 (`cryptoproc:*`, proxy map v2, …). */
+export const BARE_OS_FEATURE11_WORKER_NET_WAVE11 = 1 << 9
+/** Word11 bit 10: Telemetry NDJSON v10 / OTel v8 / audit v8. */
+export const BARE_OS_FEATURE11_TELEMETRY_AUDIT_WAVE11 = 1 << 10
+/** Word11 bit 11: CI (`verify-kernel-roadmap-wave11`). */
+export const BARE_OS_FEATURE11_DOC_CI_WAVE11 = 1 << 11
+/** Word11 bit 12: Seed RPC `http_dht_proxy_routes_v3` revision surface. */
+export const BARE_OS_FEATURE11_HTTP_DHT_PROXY_ROUTES_V3 = 1 << 12
+/** Word11 bit 13: Seed RPC `compact_ping_v5` + `ready_guard_v5` surface. */
+export const BARE_OS_FEATURE11_COMPACT_READY_RPC_V5 = 1 << 13
+
+/** Stock booter eleventh word (wave 11). */
+export const BARE_OS_KERNEL_FEATURES_STOCK_V11 =
+  BARE_OS_FEATURE11_CAP_WORD |
+  BARE_OS_FEATURE11_SEED_RPC_WAVE11 |
+  BARE_OS_FEATURE11_REPLICATION_JSON_WAVE11 |
+  BARE_OS_FEATURE11_PROC_METRICS_WAVE11 |
+  BARE_OS_FEATURE11_BOOT_POLICY_V11 |
+  BARE_OS_FEATURE11_KERNEL_EXT_REGISTRY_V8 |
+  BARE_OS_FEATURE11_PEAR_BARE_BRIDGE_WAVE11 |
+  BARE_OS_FEATURE11_VFS_POSIX_WAVE11 |
+  BARE_OS_FEATURE11_INITD_SUBPROC_WAVE11 |
+  BARE_OS_FEATURE11_WORKER_NET_WAVE11 |
+  BARE_OS_FEATURE11_TELEMETRY_AUDIT_WAVE11 |
+  BARE_OS_FEATURE11_DOC_CI_WAVE11 |
+  BARE_OS_FEATURE11_HTTP_DHT_PROXY_ROUTES_V3 |
+  BARE_OS_FEATURE11_COMPACT_READY_RPC_V5
+
 /** Bit 0: IPC fan-out / pub-sub style channels (booter `bareOsIpc`). */
 export const BARE_OS_FEATURE_IPC_FANOUT = 1 << 0

@@ -2,4 +2,4 @@
 * Published package version string for seed-channel handshake (keep in sync with package.json).
 * @type {string}
 */
-export const BARE_OS_PROTOCOL_PACKAGE_VERSION = '0.6.0'
+export const BARE_OS_PROTOCOL_PACKAGE_VERSION = '0.7.0'
@@ -89,7 +89,27 @@ export const BARE_OS_SEED_RPC_METHOD_SHORT_NAMES = [
  'ready_guard_v4',
  'mirror_drive_compaction_v5',
  'blind_relay_circuit_v3',
-  'compact_ping_v4'
+  'compact_ping_v4',
+  'hypercore_replicate_budget_v2',
+  'drive_version_graph',
+  'protomux_backpressure_v3',
+  'pear_runtime_matrix',
+  'bundle_preload_hint',
+  'autopass_rotation_hint',
+  'hrpc_method_allowlist',
+  'sidecar_resource_cap',
+  'git_lfs_budget',
+  'net_qos_class',
+  'storage_tier_hint',
+  'indexer_catchup',
+  'multisig_quorum_hint',
+  'relay_geo_hint',
+  'compact_ping_v5',
+  'staging_slot_v8',
+  'peer_firewall_stats_v6',
+  'http_dht_proxy_routes_v3',
+  'ready_guard_v5',
+  'mirror_drive_compaction_v6'
 ]

 /** @type {Set<string>} */
@@ -1,6 +1,6 @@
 {
  "name": "bare-os-protocol",
-  "version": "0.6.0",
+  "version": "0.7.0",
  "description": "MBR layout, swarm topic, and Protomux encodings for bare-operating-system",
  "type": "module",
  "main": "./index.js",
@@ -18,7 +18,8 @@ import {
  BARE_OS_KERNEL_FEATURES_STOCK_V7,
  BARE_OS_KERNEL_FEATURES_STOCK_V8,
  BARE_OS_KERNEL_FEATURES_STOCK_V9,
-  BARE_OS_KERNEL_FEATURES_STOCK_V10
+  BARE_OS_KERNEL_FEATURES_STOCK_V10,
+  BARE_OS_KERNEL_FEATURES_STOCK_V11
 } from './lib/kernel-feature-bits.js'
 import { msgDataEncoding, msgSearchReqEncoding } from './lib/messages.js'
 test('topicKey is deterministic 32-byte hash', (t) => {
@@ -103,3 +104,7 @@ test('STOCK_V9 is non-zero wave-9 advertisement', (t) => {
 test('STOCK_V10 is non-zero wave-10 advertisement', (t) => {
  t.ok((BARE_OS_KERNEL_FEATURES_STOCK_V10 >>> 0) > 0)
 })
+
+test('STOCK_V11 is non-zero wave-11 advertisement', (t) => {
+  t.ok((BARE_OS_KERNEL_FEATURES_STOCK_V11 >>> 0) > 0)
+})
@@ -411,6 +411,54 @@ async function main() {
    ),
    seederPearRuntimeBareFingerprint: String(
      hostEnv?.BARE_OS_SEED_PEAR_RUNTIME_BARE_FINGERPRINT ?? ''
+    ),
+    hypercoreReplicateBudgetV2Json: String(
+      hostEnv?.BARE_OS_SEED_HYPERCORE_REPLICATE_BUDGET_V2_JSON ?? ''
+    ),
+    driveVersionGraphJson: String(
+      hostEnv?.BARE_OS_SEED_DRIVE_VERSION_GRAPH_JSON ?? ''
+    ),
+    protomuxBackpressureV3Json: String(
+      hostEnv?.BARE_OS_SEED_PROTOMUX_BACKPRESSURE_V3_JSON ?? ''
+    ),
+    pearRuntimeMatrixJson: String(
+      hostEnv?.BARE_OS_SEED_PEAR_RUNTIME_MATRIX_JSON ?? ''
+    ),
+    bundlePreloadHintJson: String(
+      hostEnv?.BARE_OS_SEED_BUNDLE_PRELOAD_HINT_JSON ?? ''
+    ),
+    autopassRotationHintJson: String(
+      hostEnv?.BARE_OS_SEED_AUTOPASS_ROTATION_HINT_JSON ?? ''
+    ),
+    hrpcMethodAllowlistJson: String(
+      hostEnv?.BARE_OS_SEED_HRPC_METHOD_ALLOWLIST_JSON ?? ''
+    ),
+    sidecarResourceCapJson: String(
+      hostEnv?.BARE_OS_SEED_SIDECAR_RESOURCE_CAP_JSON ?? ''
+    ),
+    gitLfsBudgetJson: String(hostEnv?.BARE_OS_SEED_GIT_LFS_BUDGET_JSON ?? ''),
+    netQosClassJson: String(hostEnv?.BARE_OS_SEED_NET_QOS_CLASS_JSON ?? ''),
+    storageTierHintJson: String(
+      hostEnv?.BARE_OS_SEED_STORAGE_TIER_HINT_JSON ?? ''
+    ),
+    indexerCatchupJson: String(
+      hostEnv?.BARE_OS_SEED_INDEXER_CATCHUP_JSON ?? ''
+    ),
+    multisigQuorumHintJson: String(
+      hostEnv?.BARE_OS_SEED_MULTISIG_QUORUM_HINT_JSON ?? ''
+    ),
+    relayGeoHintJson: String(hostEnv?.BARE_OS_SEED_RELAY_GEO_HINT_JSON ?? ''),
+    compactPingV5Json: String(hostEnv?.BARE_OS_SEED_COMPACT_PING_V5_JSON ?? ''),
+    stagingSlotV8Json: String(hostEnv?.BARE_OS_SEED_STAGING_SLOT_V8_JSON ?? ''),
+    peerFirewallStatsV6Json: String(
+      hostEnv?.BARE_OS_SEED_PEER_FIREWALL_STATS_V6_JSON ?? ''
+    ),
+    httpDhtProxyRoutesV3Json: String(
+      hostEnv?.BARE_OS_SEED_HTTP_DHT_PROXY_ROUTES_V3_JSON ?? ''
+    ),
+    readyGuardV5Json: String(hostEnv?.BARE_OS_SEED_READY_GUARD_V5_JSON ?? ''),
+    mirrorDriveCompactionV6Json: String(
+      hostEnv?.BARE_OS_SEED_MIRROR_DRIVE_COMPACTION_V6_JSON ?? ''
    )
  }

@@ -12,14 +12,20 @@
  "requireFeatureBits8": 0,
  "requireFeatureBits9": 0,
  "requireFeatureBits10": 0,
+  "requireFeatureBits11": 0,
  "requireBareBootMin": "0.0.0",
  "denyBareRpcMethodPatterns": [],
  "maxPearInspectDepth": 0,
+  "maxHrpcAllowlistDepth": 0,
  "requireBareLoggerMin": "0.0.0",
  "denyAutobaseDiscoveryChannels": [],
  "requireBareTlsMin": "0.0.0",
+  "requireBarePackMin": "0.0.0",
+  "requireBareAddonPolicyMin": "0.0.0",
  "extensionSignerPinsV3": {},
+  "extensionSignerPinsV4": {},
  "offlineLkgRequirePearStamp": false,
+  "offlineLkgRequireBits11": false,
  "bootPhasesRequireLifecycleMinSchema": 0,
  "requireBareRuntimeMin": "0.0.0",
  "denySeedRpcMethods": [],
@@ -1,5 +1,5 @@
 {
-  "otlSchemaVersion": 7,
+  "otlSchemaVersion": 8,
  "scopeMetrics": [
    {
      "scope": { "name": "bare-os-example" },
@@ -1,6 +1,6 @@
 {
-  "telemetrySchemaVersion": 7,
-  "lifecycleSchemaVersion": 7,
+  "telemetrySchemaVersion": 10,
+  "lifecycleSchemaVersion": 10,
  "type": "boot",
  "ts": 0,
  "sessionId": "example-session",
@@ -130,6 +130,8 @@ function shouldSkipBootPhase(ctx, phase) {
 * Boot policy v10 (optional): `requireFeatureBits10`, `requireBareBootMin`, `denyBareRpcMethodPatterns`,
 *   `maxPearInspectDepth`, `requireBareLoggerMin`, `denyAutobaseDiscoveryChannels`, `requireBareTlsMin`,
 *   `extensionSignerPinsV3`, `offlineLkgRequirePearStamp`, `bootPhasesRequireLifecycleMinSchema`.
+ * Boot policy v11 (optional): `requireFeatureBits11`, `extensionSignerPinsV4`, `requireBarePackMin`,
+ *   `requireBareAddonPolicyMin`, `maxHrpcAllowlistDepth`, `offlineLkgRequireBits11`.
 * @param {Record<string, unknown>} ctx
 * @returns {Promise<boolean>} false when strict policy fails (caller should abort boot)
 */
@@ -382,6 +384,24 @@ async function applyBootPolicyFile(ctx) {
        }
      }
    }
+    if (
+      typeof pol.requireFeatureBits11 === 'number' &&
+      pol.requireFeatureBits11 > 0
+    ) {
+      const adv11 = ctx.bareOsAdvertisedKernelBits11
+      const need11 = pol.requireFeatureBits11 >>> 0
+      const ok =
+        typeof adv11 === 'number' && ((adv11 >>> 0) & need11) === need11
+      if (!ok) {
+        console.error('[boot-policy] requireFeatureBits11 not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
    if (
      pol.requirePearRuntimeRange &&
      typeof pol.requirePearRuntimeRange === 'object'
@@ -601,8 +621,15 @@ async function applyBootPolicyFile(ctx) {
      const parts = pol.denySeedRpcMethods
        .map((m) => String(m).trim())
        .filter(Boolean)
-      if (parts.length) {
-        ctx.env.BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS = parts.join(',')
+      const existing = String(
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS || ''
+      )
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean)
+      const merged = [...new Set([...existing, ...parts])]
+      if (merged.length) {
+        ctx.env.BARE_OS_BOOT_POLICY_DENY_SEED_RPC_METHODS = merged.join(',')
      }
    }
    if (
@@ -687,6 +714,18 @@ async function applyBootPolicyFile(ctx) {
        /* ignore */
      }
    }
+    if (
+      pol.extensionSignerPinsV4 &&
+      typeof pol.extensionSignerPinsV4 === 'object' &&
+      ctx.env
+    ) {
+      try {
+        ctx.env.BARE_OS_BOOT_POLICY_EXTENSION_SIGNER_PINS_V4_JSON =
+          JSON.stringify(pol.extensionSignerPinsV4)
+      } catch {
+        /* ignore */
+      }
+    }
    if (
      typeof pol.requireBareBootMin === 'string' &&
      String(pol.requireBareBootMin).trim()
@@ -725,6 +764,15 @@ async function applyBootPolicyFile(ctx) {
        Math.min(64, Math.floor(pol.maxPearInspectDepth))
      )
    }
+    if (
+      typeof pol.maxHrpcAllowlistDepth === 'number' &&
+      pol.maxHrpcAllowlistDepth >= 0 &&
+      ctx.env
+    ) {
+      ctx.env.BARE_OS_BOOT_POLICY_MAX_HRPC_ALLOWLIST_DEPTH = String(
+        Math.min(64, Math.floor(pol.maxHrpcAllowlistDepth))
+      )
+    }
    if (
      typeof pol.requireBareLoggerMin === 'string' &&
      String(pol.requireBareLoggerMin).trim()
@@ -772,9 +820,49 @@ async function applyBootPolicyFile(ctx) {
        }
      }
    }
+    if (
+      typeof pol.requireBarePackMin === 'string' &&
+      String(pol.requireBarePackMin).trim()
+    ) {
+      const needS = String(pol.requireBarePackMin).trim()
+      const haveS =
+        ctx.env && String(ctx.env.BARE_OS_BARE_PACK_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBarePackMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
+    if (
+      typeof pol.requireBareAddonPolicyMin === 'string' &&
+      String(pol.requireBareAddonPolicyMin).trim()
+    ) {
+      const needS = String(pol.requireBareAddonPolicyMin).trim()
+      const haveS =
+        ctx.env &&
+        String(ctx.env.BARE_OS_BARE_ADDON_POLICY_VERSION || '').trim()
+      const ok = haveS && semverGte(haveS, needS)
+      if (!ok) {
+        console.error('[boot-policy] requireBareAddonPolicyMin not satisfied')
+        if (strictPol) {
+          if (typeof ctx.requestBooterExit === 'function') {
+            ctx.requestBooterExit(1)
+          }
+          return false
+        }
+      }
+    }
    if (pol.offlineLkgRequirePearStamp === true && ctx.env) {
      ctx.env.BARE_OS_OFFLINE_LKG_REQUIRE_PEAR_STAMP = '1'
    }
+    if (pol.offlineLkgRequireBits11 === true && ctx.env) {
+      ctx.env.BARE_OS_OFFLINE_LKG_REQUIRE_BITS11 = '1'
+    }
    if (
      typeof pol.offlineLkgManifestMaxAgeSec === 'number' &&
      pol.offlineLkgManifestMaxAgeSec > 0 &&
@@ -1039,9 +1127,19 @@ async function bootTimed(ctx, label, fn, phaseLog) {
        sessionId: sid,
        ts: Date.now()
      }
+      const w11 = ctx.env && String(ctx.env.BARE_OS_WAVE11_PROBE_ID || '').trim()
+      if (w11) rec.wave11ProbeId = w11.slice(0, 128)
+      const bp = ctx.env && String(ctx.env.BARE_OS_BARE_PACK_VERSION || '').trim()
+      if (bp) rec.barePackVersionHint = bp.slice(0, 64)
+      const ap = ctx.env &&
+        String(ctx.env.BARE_OS_BARE_ADDON_POLICY_VERSION || '').trim()
+      if (ap) rec.bareAddonPolicyVersionHint = ap.slice(0, 64)
      ctx.console.error(JSON.stringify(rec))
    } else if (isBootTraceJson(ctx)) {
-      ctx.console.error(JSON.stringify({ phase: label, ms }))
+      const base = { phase: label, ms }
+      const w11 = ctx.env && String(ctx.env.BARE_OS_WAVE11_PROBE_ID || '').trim()
+      if (w11) base.wave11ProbeId = w11.slice(0, 128)
+      ctx.console.error(JSON.stringify(base))
    } else {
      ctx.console.error(`[boot] ${label}: ${ms}ms`)
    }
@@ -19,12 +19,6 @@
        "hypercoreIdEncoding"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/compactEncoding.js",
-      "keys": [
-        "compactEncoding"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareUrl.js",
      "keys": [
@@ -32,15 +26,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/protomux.js",
+      "path": "/lib/bare/bundles/compactEncoding.js",
      "keys": [
-        "protomux"
+        "compactEncoding"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareEvents.js",
+      "path": "/lib/bare/bundles/protomux.js",
      "keys": [
-        "bareEvents"
+        "protomux"
      ]
    },
    {
@@ -55,6 +49,12 @@
        "barePath"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareEvents.js",
+      "keys": [
+        "bareEvents"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareAbort.js",
      "keys": [
@@ -67,18 +67,6 @@
        "bareAbortController"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAddonResolve.js",
-      "keys": [
-        "bareAddonResolve"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
-      "keys": [
-        "bareAnsiEscapes"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareReadline.js",
      "keys": [
@@ -92,9 +80,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareApk.js",
+      "path": "/lib/bare/bundles/bareAnsiEscapes.js",
      "keys": [
-        "bareApk"
+        "bareAnsiEscapes"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAddonResolve.js",
+      "keys": [
+        "bareAddonResolve"
      ]
    },
    {
@@ -109,18 +103,24 @@
        "bareAppKit"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareAssert.js",
-      "keys": [
-        "bareAssert"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareAsyncHooks.js",
      "keys": [
        "bareAsyncHooks"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareApk.js",
+      "keys": [
+        "bareApk"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareAssert.js",
+      "keys": [
+        "bareAssert"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareAtomics.js",
      "keys": [
@@ -133,6 +133,12 @@
        "bareBmp"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "keys": [
+        "bareBundleCompile"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareBundle.js",
      "keys": [
@@ -152,9 +158,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareBundleCompile.js",
+      "path": "/lib/bare/bundles/bareBoot.js",
      "keys": [
-        "bareBundleCompile"
+        "bareBoot"
      ]
    },
    {
@@ -163,12 +169,6 @@
        "bareBundleEvaluate"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareBoot.js",
-      "keys": [
-        "bareBoot"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareConsole.js",
      "keys": [
@@ -206,9 +206,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareEnv.js",
+      "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
      "keys": [
-        "bareEnv"
+        "bareDiagnosticsChannel"
      ]
    },
    {
@@ -217,12 +217,6 @@
        "bareDns"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareDiagnosticsChannel.js",
-      "keys": [
-        "bareDiagnosticsChannel"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareCov.js",
      "keys": [
@@ -230,9 +224,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDgram.js",
+      "path": "/lib/bare/bundles/bareEnv.js",
      "keys": [
-        "bareDgram"
+        "bareEnv"
      ]
    },
    {
@@ -242,9 +236,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareFfmpeg.js",
+      "path": "/lib/bare/bundles/bareDgram.js",
      "keys": [
-        "bareFfmpeg"
+        "bareDgram"
      ]
    },
    {
@@ -254,21 +248,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareFormat.js",
+      "path": "/lib/bare/bundles/bareFfmpeg.js",
      "keys": [
-        "bareFormat"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFormData.js",
-      "keys": [
-        "bareFormData"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareFileLogger.js",
-      "keys": [
-        "bareFileLogger"
+        "bareFfmpeg"
      ]
    },
    {
@@ -277,12 +259,36 @@
        "bareGif"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFormat.js",
+      "keys": [
+        "bareFormat"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFileLogger.js",
+      "keys": [
+        "bareFileLogger"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareFormData.js",
+      "keys": [
+        "bareFormData"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareHeif.js",
      "keys": [
        "bareHeif"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareFs.js",
+      "keys": [
+        "bareFs"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareGtk.js",
      "keys": [
@@ -307,24 +313,12 @@
        "bareIco"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareFs.js",
-      "keys": [
-        "bareFs"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareImageResample.js",
      "keys": [
        "bareImageResample"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareHttp1.js",
-      "keys": [
-        "bareHttp1"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareInspect.js",
      "keys": [
@@ -332,15 +326,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareHttps.js",
+      "path": "/lib/bare/bundles/bareHttp1.js",
      "keys": [
-        "bareHttps"
+        "bareHttp1"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareJpeg.js",
+      "path": "/lib/bare/bundles/bareHttps.js",
      "keys": [
-        "bareJpeg"
+        "bareHttps"
      ]
    },
    {
@@ -350,15 +344,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareIpc.js",
+      "path": "/lib/bare/bundles/bareJpeg.js",
      "keys": [
-        "bareIpc"
+        "bareJpeg"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareLief.js",
+      "path": "/lib/bare/bundles/bareIpc.js",
      "keys": [
-        "bareLief"
+        "bareIpc"
      ]
    },
    {
@@ -373,12 +367,24 @@
        "bareInspector"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareLief.js",
+      "keys": [
+        "bareLief"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareLink.js",
      "keys": [
        "bareLink"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareDev.js",
+      "keys": [
+        "bareDev"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareMake.js",
      "keys": [
@@ -409,12 +415,6 @@
        "bareModuleTraverse"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareNative.js",
-      "keys": [
-        "bareNative"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareNdk.js",
      "keys": [
@@ -428,15 +428,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareMedia.js",
+      "path": "/lib/bare/bundles/bareNative.js",
      "keys": [
-        "bareMedia"
+        "bareNative"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareOpen.js",
+      "path": "/lib/bare/bundles/bareMedia.js",
      "keys": [
-        "bareOpen"
+        "bareMedia"
      ]
    },
    {
@@ -445,30 +445,30 @@
        "bareOs"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareOpen.js",
+      "keys": [
+        "bareOpen"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareNet.js",
      "keys": [
        "bareNet"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/barePerformance.js",
-      "keys": [
-        "barePerformance"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePipe.js",
-      "keys": [
-        "barePipe"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/barePack.js",
      "keys": [
        "barePack"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePerformance.js",
+      "keys": [
+        "barePerformance"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePackDrive.js",
      "keys": [
@@ -482,21 +482,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/barePunycode.js",
+      "path": "/lib/bare/bundles/barePipe.js",
      "keys": [
-        "barePunycode"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/barePrebuild.js",
-      "keys": [
-        "barePrebuild"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareNodeRuntime.js",
-      "keys": [
-        "bareNodeRuntime"
+        "barePipe"
      ]
    },
    {
@@ -505,6 +493,12 @@
        "bareQuerystring"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/barePunycode.js",
+      "keys": [
+        "barePunycode"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareQueueMicrotask.js",
      "keys": [
@@ -512,9 +506,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareProcess.js",
+      "path": "/lib/bare/bundles/barePrebuild.js",
      "keys": [
-        "bareProcess"
+        "barePrebuild"
      ]
    },
    {
@@ -523,6 +517,12 @@
        "bareRealm"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareNodeRuntime.js",
+      "keys": [
+        "bareNodeRuntime"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/barePromClient.js",
      "keys": [
@@ -530,9 +530,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareDev.js",
+      "path": "/lib/bare/bundles/bareProcess.js",
      "keys": [
-        "bareDev"
+        "bareProcess"
      ]
    },
    {
@@ -542,9 +542,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSdl.js",
+      "path": "/lib/bare/bundles/bareRepl.js",
      "keys": [
-        "bareSdl"
+        "bareRepl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareRpc.js",
+      "keys": [
+        "bareRpc"
      ]
    },
    {
@@ -553,6 +559,12 @@
        "bareSemver"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareSdl.js",
+      "keys": [
+        "bareSdl"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareRun.js",
      "keys": [
@@ -565,36 +577,12 @@
        "bareSidecar"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareRpc.js",
-      "keys": [
-        "bareRpc"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareRepl.js",
-      "keys": [
-        "bareRepl"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareSignals.js",
      "keys": [
        "bareSignals"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareStringDecoder.js",
-      "keys": [
-        "bareStringDecoder"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStorage.js",
-      "keys": [
-        "bareStorage"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareStream.js",
      "keys": [
@@ -602,15 +590,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSvg.js",
+      "path": "/lib/bare/bundles/bareStorage.js",
      "keys": [
-        "bareSvg"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareStructuredClone.js",
-      "keys": [
-        "bareStructuredClone"
+        "bareStorage"
      ]
    },
    {
@@ -620,15 +602,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "path": "/lib/bare/bundles/bareStringDecoder.js",
      "keys": [
-        "bareSystemLogger"
+        "bareStringDecoder"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareSubprocess.js",
+      "path": "/lib/bare/bundles/bareSvg.js",
      "keys": [
-        "bareSubprocess"
+        "bareSvg"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareSystemLogger.js",
+      "keys": [
+        "bareSystemLogger"
      ]
    },
    {
@@ -638,15 +626,21 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTiff.js",
+      "path": "/lib/bare/bundles/bareSubprocess.js",
      "keys": [
-        "bareTiff"
+        "bareSubprocess"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTimers.js",
+      "path": "/lib/bare/bundles/bareStructuredClone.js",
      "keys": [
-        "bareTimers"
+        "bareStructuredClone"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTiff.js",
+      "keys": [
+        "bareTiff"
      ]
    },
    {
@@ -655,12 +649,6 @@
        "bareThread"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareTpl.js",
-      "keys": [
-        "bareTpl"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareTcp.js",
      "keys": [
@@ -668,9 +656,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTls.js",
+      "path": "/lib/bare/bundles/bareTpl.js",
      "keys": [
-        "bareTls"
+        "bareTpl"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareTimers.js",
+      "keys": [
+        "bareTimers"
      ]
    },
    {
@@ -680,9 +674,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareTty.js",
+      "path": "/lib/bare/bundles/bareTls.js",
      "keys": [
-        "bareTty"
+        "bareTls"
      ]
    },
    {
@@ -698,15 +692,15 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareV8.js",
+      "path": "/lib/bare/bundles/bareTty.js",
      "keys": [
-        "bareV8"
+        "bareTty"
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareVm.js",
+      "path": "/lib/bare/bundles/bareV8.js",
      "keys": [
-        "bareVm"
+        "bareV8"
      ]
    },
    {
@@ -722,9 +716,9 @@
      ]
    },
    {
-      "path": "/lib/bare/bundles/bareWebKit.js",
+      "path": "/lib/bare/bundles/bareVm.js",
      "keys": [
-        "bareWebKit"
+        "bareVm"
      ]
    },
    {
@@ -733,6 +727,24 @@
        "bareWebKitGtk"
      ]
    },
+    {
+      "path": "/lib/bare/bundles/bareWebKit.js",
+      "keys": [
+        "bareWebKit"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareUtils.js",
+      "keys": [
+        "bareUtils"
+      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
+      "keys": [
+        "bareV8ToIstanbul"
+      ]
+    },
    {
      "path": "/lib/bare/bundles/bareWebp.js",
      "keys": [
@@ -745,18 +757,6 @@
        "bareWhich"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareV8ToIstanbul.js",
-      "keys": [
-        "bareV8ToIstanbul"
-      ]
-    },
-    {
-      "path": "/lib/bare/bundles/bareUtils.js",
-      "keys": [
-        "bareUtils"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWinUi.js",
      "keys": [
@@ -781,17 +781,17 @@
        "bareZmq"
      ]
    },
-    {
-      "path": "/lib/bare/bundles/bareWs.js",
-      "keys": [
-        "bareWs"
-      ]
-    },
    {
      "path": "/lib/bare/bundles/bareWorker.js",
      "keys": [
        "bareWorker"
      ]
+    },
+    {
+      "path": "/lib/bare/bundles/bareWs.js",
+      "keys": [
+        "bareWs"
+      ]
    }
  ],
  "bundleStats": {
@@ -61,6 +61,12 @@ Asserts **`feature-roadmap.md`** contains a **`## Wave 9`** section with at leas

 Asserts **`feature-roadmap.md`** contains a **`## Wave 10`** section with at least **100** numbered table rows. Root **`pretest`**.

+## `verify-kernel-roadmap-wave11.mjs`
+
+**Usage:** `node scripts/verify-kernel-roadmap-wave11.mjs`
+
+Asserts **`feature-roadmap.md`** contains a **`## Wave 11`** section with at least **100** numbered table rows. Root **`pretest`**.
+
 ## `verify-pear-no-static-node-import.mjs`

 **Usage:** `node scripts/verify-pear-no-static-node-import.mjs`
@@ -71,7 +77,7 @@ Fails on **`from 'node:…'`** static imports under **`packages/bare-os-booter/i

 **Usage:** `node scripts/verify-ctx-dts.mjs`

-Ensures **`bare-os-ctx.d.ts`** lists new **`ctx`** fields (**`bareOsAdvertisedKernelBits4`**–**`bits10`**, Bare runtime semver, protocol/Pear runtime semver, subprocess snapshot, profile reload, delegate fairness, IPC audit, Pear / bundlebee / diagnostics / hrpc / structured-clone / wave9–10 stubs, …) that exist in **`packages/bare-os-booter/index.js`**. Root **`pretest`**.
+Ensures **`bare-os-ctx.d.ts`** lists new **`ctx`** fields (**`bareOsAdvertisedKernelBits4`**–**`bits11`**, Bare runtime semver, protocol/Pear runtime semver, subprocess snapshot, profile reload, delegate fairness, IPC audit, Pear / bundlebee / diagnostics / hrpc / structured-clone / wave9–11 stubs, …) that exist in **`packages/bare-os-booter/index.js`**. Root **`pretest`**.

 ## `verify-doc-links.mjs`

@@ -71,3 +71,6 @@ console.log(
 console.log(
  '[release-checklist] Wave 8 release notes template: bits8 + STOCK_V8, protocol 0.4.x, ctx 1.17.x, boot.policy v8 (Bare runtime semver, denySeedRpcMethods, protomux channel name cap), Wave 8 seed RPCs + /proc index schema 4, NDJSON lifecycle 7 / OTel 5 / audit 5 — see feature-roadmap.md Wave 8 table'
 )
+console.log(
+  '[release-checklist] Wave 11 release notes template: bits11 + STOCK_V11, protocol 0.7.x, ctx 1.20.x, boot.policy v11 (requireFeatureBits11, extensionSignerPinsV4, pack/addon mins, maxHrpcAllowlistDepth, offlineLkgRequireBits11), 20 Wave 11 seed RPCs + /proc index schema 7, NDJSON lifecycle 10 / OTel 8 / audit 8, optional BARE_OS_WAVE11_PROC to hide wave-11 proc JSON — see feature-roadmap.md Wave 11 table'
+)
@@ -77,6 +77,10 @@ function main() {
    console.error('compatibility-matrix.md should mention bits10 capability word')
    process.exit(1)
  }
+  if (!md.includes('**`bits11`**') && !md.includes('bits11')) {
+    console.error('compatibility-matrix.md should mention bits11 capability word')
+    process.exit(1)
+  }
  if (!md.includes('`' + lifeMatch[1] + '`')) {
    console.error(
      'compatibility-matrix.md must list BARE_OS_LIFECYCLE_SCHEMA_VERSION',
@@ -84,6 +84,10 @@ function main() {
    console.error('index.js should wire seed/features bits10')
    process.exit(1)
  }
+  if (!idx.includes('bits11')) {
+    console.error('index.js should wire seed/features bits11')
+    process.exit(1)
+  }
  if (!idx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V6')) {
    console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V6')
    process.exit(1)
@@ -104,6 +108,10 @@ function main() {
    console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V10')
    process.exit(1)
  }
+  if (!idx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V11')) {
+    console.error('index.js should reference BARE_OS_KERNEL_FEATURES_STOCK_V11')
+    process.exit(1)
+  }

  const bitsSrc = read(bitsPath)
  if (!bitsSrc.includes('export const BARE_OS_KERNEL_FEATURES_STOCK_V1')) {
@@ -166,6 +174,12 @@ function main() {
    )
    process.exit(1)
  }
+  if (!bitsSrc.includes('export const BARE_OS_KERNEL_FEATURES_STOCK_V11')) {
+    console.error(
+      'kernel-feature-bits.js missing BARE_OS_KERNEL_FEATURES_STOCK_V11'
+    )
+    process.exit(1)
+  }
  const docMatch = bitsSrc.match(
    /export const BARE_OS_KERNEL_FEATURE_BITS_DOC = (\d+)/
  )
@@ -173,8 +187,8 @@ function main() {
    console.error('Could not parse BARE_OS_KERNEL_FEATURE_BITS_DOC')
    process.exit(1)
  }
-  if (docMatch[1] !== '12') {
-    console.error('Expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 12 for wave 10')
+  if (docMatch[1] !== '13') {
+    console.error('Expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 13 for wave 11')
    process.exit(1)
  }

@@ -41,6 +41,8 @@ const needles = [
  'bareOsSeedCapabilityBits9',
  'bareOsAdvertisedKernelBits10',
  'bareOsSeedCapabilityBits10',
+  'bareOsAdvertisedKernelBits11',
+  'bareOsSeedCapabilityBits11',
  'bareOsEmitPearStageHint',
  'bareOsBareModuleResolveProbe',
  'bareOsBareCryptoCapProbe',
@@ -53,7 +55,10 @@ const needles = [
  'bareOsEmitAutobaseDiscoveryHint',
  'bareOsEmitBlindPairingSketch',
  'bareOsBareStreamBackpressureHint',
-  'bareOsPearTerminalCapsProbe'
+  'bareOsPearTerminalCapsProbe',
+  'bareOsEmitHypercoreReplicateBudget',
+  'bareOsPearRuntimeMatrixProbe',
+  'bareOsBarePackCacheProbe'
 ]

 function main() {
@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+/**
+ * CI: Wave 11 mega-phase — feature-roadmap.md must contain 100 numbered rows under "## Wave 11".
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+function read(rel) {
+  return fs.readFileSync(path.join(root, rel), 'utf8')
+}
+
+function main() {
+  const md = read('docs/reference/feature-roadmap.md')
+  const idx = md.indexOf('## Wave 11')
+  if (idx < 0) {
+    console.error('feature-roadmap.md missing ## Wave 11 section')
+    process.exit(1)
+  }
+  const rest = md.slice(idx + '## Wave 11'.length)
+  const nextH2 = rest.search(/\n## /)
+  const block = nextH2 < 0 ? rest : rest.slice(0, nextH2)
+  let count = 0
+  for (const line of block.split('\n')) {
+    if (/^\| *[0-9]+ *\|/.test(line)) count++
+  }
+  if (count < 100) {
+    console.error(
+      'verify-kernel-roadmap-wave11: expected >=100 table rows in Wave 11, got',
+      count
+    )
+    process.exit(1)
+  }
+  console.log('verify-kernel-roadmap-wave11: OK', count, 'rows')
+}
+
+main()
@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * CI: roadmap wave-3 … wave-10 contract checks (bits10, seed RPC registry, boot policy keys).
+ * CI: roadmap wave-3 … wave-11 contract checks (bits11, seed RPC registry, boot policy keys).
 */
 import fs from 'node:fs'
 import path from 'node:path'
@@ -43,9 +43,13 @@ function main() {
    console.error('kernel-feature-bits.js missing STOCK_V10')
    process.exit(1)
  }
-  if (!bits.includes('BARE_OS_KERNEL_FEATURE_BITS_DOC = 12')) {
+  if (!bits.includes('BARE_OS_KERNEL_FEATURES_STOCK_V11')) {
+    console.error('kernel-feature-bits.js missing STOCK_V11')
+    process.exit(1)
+  }
+  if (!bits.includes('BARE_OS_KERNEL_FEATURE_BITS_DOC = 13')) {
    console.error(
-      'kernel-feature-bits.js: expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 12'
+      'kernel-feature-bits.js: expected BARE_OS_KERNEL_FEATURE_BITS_DOC = 13'
    )
    process.exit(1)
  }
@@ -82,6 +86,10 @@ function main() {
    console.error('channel.js capabilities must include bits10')
    process.exit(1)
  }
+  if (!chan.includes('bits11:')) {
+    console.error('channel.js capabilities must include bits11')
+    process.exit(1)
+  }
  const seedRpc = read('packages/bare-os-protocol/lib/seed-rpc-methods.js')
  if (!seedRpc.includes('BARE_OS_SEED_RPC_METHOD_SHORT_NAMES')) {
    console.error('seed-rpc-methods.js missing method list')
@@ -169,7 +177,27 @@ function main() {
    'ready_guard_v4',
    'mirror_drive_compaction_v5',
    'blind_relay_circuit_v3',
-    'compact_ping_v4'
+    'compact_ping_v4',
+    'hypercore_replicate_budget_v2',
+    'drive_version_graph',
+    'protomux_backpressure_v3',
+    'pear_runtime_matrix',
+    'bundle_preload_hint',
+    'autopass_rotation_hint',
+    'hrpc_method_allowlist',
+    'sidecar_resource_cap',
+    'git_lfs_budget',
+    'net_qos_class',
+    'storage_tier_hint',
+    'indexer_catchup',
+    'multisig_quorum_hint',
+    'relay_geo_hint',
+    'compact_ping_v5',
+    'staging_slot_v8',
+    'peer_firewall_stats_v6',
+    'http_dht_proxy_routes_v3',
+    'ready_guard_v5',
+    'mirror_drive_compaction_v6'
  ]) {
    if (!seedRpc.includes("'" + rpc + "'")) {
      console.error('seed-rpc-methods.js missing short name', rpc)
@@ -205,6 +233,10 @@ function main() {
    console.error('booter index.js must import STOCK_V10')
    process.exit(1)
  }
+  if (!bootIdx.includes('BARE_OS_KERNEL_FEATURES_STOCK_V11')) {
+    console.error('booter index.js must import STOCK_V11')
+    process.exit(1)
+  }
  if (!bootIdx.includes('bits6 do not cover stock')) {
    console.error('booter must strict-check bits6')
    process.exit(1)
@@ -225,6 +257,10 @@ function main() {
    console.error('booter must strict-check bits10')
    process.exit(1)
  }
+  if (!bootIdx.includes('bits11 do not cover stock')) {
+    console.error('booter must strict-check bits11')
+    process.exit(1)
+  }
  if (!bootIdx.includes('loadOsFromOfflineLkg')) {
    console.error('booter index.js must define loadOsFromOfflineLkg')
    process.exit(1)
@@ -260,14 +296,20 @@ function main() {
    'requireFeatureBits8',
    'requireFeatureBits9',
    'requireFeatureBits10',
+    'requireFeatureBits11',
    'requireBareBootMin',
    'denyBareRpcMethodPatterns',
    'maxPearInspectDepth',
+    'maxHrpcAllowlistDepth',
    'requireBareLoggerMin',
    'denyAutobaseDiscoveryChannels',
    'requireBareTlsMin',
+    'requireBarePackMin',
+    'requireBareAddonPolicyMin',
    'extensionSignerPinsV3',
+    'extensionSignerPinsV4',
    'offlineLkgRequirePearStamp',
+    'offlineLkgRequireBits11',
    'bootPhasesRequireLifecycleMinSchema',
    'requirePearRuntimeRange',
    'denyBareModuleSpecifierPatterns',
@@ -329,6 +371,10 @@ function main() {
    console.error('kernel/init.js must enforce requireFeatureBits10')
    process.exit(1)
  }
+  if (!kInit.includes('requireFeatureBits11')) {
+    console.error('kernel/init.js must enforce requireFeatureBits11')
+    process.exit(1)
+  }
  if (!kInit.includes('requireBareRuntimeMin')) {
    console.error('kernel/init.js must enforce requireBareRuntimeMin')
    process.exit(1)